Getting Data In

Impact analysis of upgrade of Splunk UF agent on Cloud instance

Gayatri
Explorer

Hi Team,

Currently, we are using Splunk UF agents which is installed on all infra servers and which receives configuration from Deployment servers and both are running under 9.1.2 version. And these logs are getting forwarded to Splunk cloud console via Cribl workers.

And the Splunk cloud instance indexer and search head running with 9.2.2 version. Now, our ask is if we upgrade our Splunk UF and Splunk enterprise version on deployment servers from 9.1.2 to 9.3.0, will it impact the cloud components (due to compatibility issues) or will it not impact as these cloud components receives logs indirectly via cribl? Could you please clarify?

0 Karma

Gayatri
Explorer

Thank you for the response!!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

In general, recommended practice is to have lower-tier processes run an older version than the higher-tier processes (tiers go from forwarders up to indexers, search heads, and managers).  Since Cribl is in the mix, however, it's more important for the forwarders to run a version that is compatible with the workers.

---
If this reply helps you, Karma would be appreciated.
0 Karma

Gayatri
Explorer

Thank you for the information.  So, if the upgraded version is in compatible with the Cribl workers then can we go for upgrade even though the final downstream cloud components runs with lower version?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Presuming the Cribl worker is compatible with the Cloud component and hides any incompatibility from the forwarder, then, yes.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...