Impact analysis of upgrade of Splunk UF agent on Cloud instance

[Gayatri]

Hi Team,

Currently, we are using Splunk UF agents which is installed on all infra servers and which receives configuration from Deployment servers and both are running under 9.1.2 version. And these logs are getting forwarded to Splunk cloud console via Cribl workers.

And the Splunk cloud instance indexer and search head running with 9.2.2 version. Now, our ask is if we upgrade our Splunk UF and Splunk enterprise version on deployment servers from 9.1.2 to 9.3.0, will it impact the cloud components (due to compatibility issues) or will it not impact as these cloud components receives logs indirectly via cribl? Could you please clarify?

[Gayatri]

Thank you for the response!!

[richgalloway]

In general, recommended practice is to have lower-tier processes run an older version than the higher-tier processes (tiers go from forwarders up to indexers, search heads, and managers).  Since Cribl is in the mix, however, it's more important for the forwarders to run a version that is compatible with the workers.

[Gayatri]

Thank you for the information.  So, if the upgraded version is in compatible with the Cribl workers then can we go for upgrade even though the final downstream cloud components runs with lower version?

[richgalloway]

Presuming the Cribl worker is compatible with the Cloud component and hides any incompatibility from the forwarder, then, yes.