Getting Data In
Highlighted

Can a heavy forwarder be higher version than indexers?

Path Finder

Hi,

I don't think that I found this kind of question before but in general I know the case for different versions between the indexers-search heads but my question is:
Can a heavy forwarder be higher version than indexers?

0 Karma
Highlighted

Re: Can a heavy forwarder be higher version than indexers?

SplunkTrust
SplunkTrust

@a_naoum

Check "Determine forwarder-indexer compatibility" section in below link.

https://docs.splunk.com/Documentation/Forwarder/7.2.6/Forwarder/Compatibilitybetweenforwardersandind...

Highlighted

Re: Can a heavy forwarder be higher version than indexers?

Path Finder

As others mention is it applicable for HF?

Highlighted

Re: Can a heavy forwarder be higher version than indexers?

Motivator

Hi @a_naoum,

Indexer should be in higher version than the forwarder, please visit Forwarder Compatibility.

Highlighted

Re: Can a heavy forwarder be higher version than indexers?

Communicator

Technically yes, but there are limitations on what kind of Data forwarder can send, if you maintain higher version of HF.
Please refer to the below compatibility matrix.
https://docs.splunk.com/Documentation/Forwarder/7.2.6/Forwarder/Compatibilitybetweenforwardersandind...

0 Karma
Highlighted

Re: Can a heavy forwarder be higher version than indexers?

SplunkTrust
SplunkTrust

I would like to point out that question is for Heavy Forwarder, however Forwarder compatibility link which is provided in answer is for Comparability between Universal Forwarder and Splunk Indexer.

Heavy Forwarder is same as Splunk Indexer (Search Peer), only difference is Heavy Forwarder do not store data in general and pass parsed data to Indexer so based on my knowledge this is correct link from doc https://docs.splunk.com/Documentation/Splunk/7.2.6/Indexer/Systemrequirements#Compatibility_between_... for compatibility between Heavy Forwarder and Indexer, please correct me if I am wrong.