Getting Data In

Do we have to enable/configure SSL on our 6.4.3 UFs before we upgrade to 7.1.2?

Branden
Builder

We are upgrading our Splunk Indexer from 6.4.3 to 7.1.2 (via 6.5). Our forwarders are running a mixture of 6.2.4 and 6.4.3 and are NOT using SSL.
Then I noticed this compatibility matrix for the UFs: http://docs.splunk.com/Documentation/Forwarder/7.1.2/Forwarder/Compatibilitybetweenforwardersandinde...

If I read this correctly, does this mean we must enable/configure SSL on our 6.4.3 UFs before we upgrade? Or will we still be able to send data to the 7.1.2 indexer without SSL from the older UFs?

Thanks!

0 Karma
1 Solution

jtacy
Builder

Non-SSL forwarding is still supported but if you do decide to use SSL at some point, you'll have to work out the version/cipher compatibility between UF and Indexer. Your configuration should work just fine the way it is.

If your UFs are configured as deployment clients and you're updating your Deployment Server, consider that the SSL/TLS config for the management port in 6.6+ is affected by the version/cipher changes and you'll need to work out a solution for that. The Known Issues page at http://docs.splunk.com/Documentation/Splunk/7.1.2/ReleaseNotes/KnownIssues suggests some configurations you could use on the server side to support legacy clients.

View solution in original post

jtacy
Builder

Non-SSL forwarding is still supported but if you do decide to use SSL at some point, you'll have to work out the version/cipher compatibility between UF and Indexer. Your configuration should work just fine the way it is.

If your UFs are configured as deployment clients and you're updating your Deployment Server, consider that the SSL/TLS config for the management port in 6.6+ is affected by the version/cipher changes and you'll need to work out a solution for that. The Known Issues page at http://docs.splunk.com/Documentation/Splunk/7.1.2/ReleaseNotes/KnownIssues suggests some configurations you could use on the server side to support legacy clients.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...