Getting Data In

Is it expected behavior for 6.4.1 universal forwarders to work with 6.3.3 indexers?

Builder

All,

We accidentally rolled out dozens of 6.4.1 Universal Forwarders, but we have 6.3.3 indexers. To my surprise, it worked! No errors. Is this expected behavior? It's a lot of effort to downgrade our UFs, so if I am supported in this setting, I'd like to leave it.

0 Karma

Splunk Employee
Splunk Employee
0 Karma