Can you simply delete the 6.4.3 forwarder and installing the 7.2.1 forwarder?

[Branden]

Hi. We are running Splunk Enterprise 6.4.3, and our Universal Forwarders are running the same version. We'll be upgrading to Splunk Enterprise to 7.2.1, which I understand involves a hop to 6.5, then an upgrade to 7.1.x.

We want to upgrade our Universal Forwarders as well. Does upgrading the forwarders from 6.4.3 -> 7.1.x also require the extra hop? Or can they go from straight from 6.4.3 to 7.2.1?

Thanks!

[CarsonZa · Accepted solution]

according to the documentation yes, upgrade your forwarders to 6.5 first.

From version 6.5 or later to 7.1 on Splunk universal forwarders.

http://docs.splunk.com/Documentation/Splunk/7.1.1/Installation/AboutupgradingREADTHISFIRST

[Branden]

Glossed right over that line. Thanks. 🙂