Getting Data In

Is it safe to use a 6.5.2 universal forwarder with a 6.5.1 indexer?

broomejohnp
New Member

I would like to deploy the latest 64-bit Windows forwarder (6.5.2) but we are still at 6.5.1 for our indexers.

0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

@broomejohnp - Did one of the answers below help provide a solution your question? If yes, please click “Accept” below the best answer to resolve this post and upvote anything that was helpful. If no, please leave a comment with more feedback. Thanks.

0 Karma

nickhills
Ultra Champion

As @somesoni2 mentioned its probably best practice to keep everything at the same version, but the important line from the link reads:

A universal forwarder that is version 6.0 or later can send data to a Splunk Enterprise indexer that is version 5.0 or later

In our environment I have several hundred universal forwarders running 6.5.2 forwarding to a 6.5.0 index cluster with no issues.

If my comment helps, please give it a thumbs up!

somesoni2
SplunkTrust
SplunkTrust

It's recommended (for best practices) that indexers should be at same or higher version as the forwarder, for best results, but since both are same major version, I don't see any issues in that. For more info on the restrictions, see this.

http://docs.splunk.com/Documentation/Forwarder/6.5.2/Forwarder/Compatibilitybetweenforwardersandinde...

ddrillic
Ultra Champion

Fascinating -

alt text

0 Karma
Get Updates on the Splunk Community!

Observability Unveiled: Navigating OpenTelemetry's Framework and Deployment Options

Observability Unveiled: Navigating OpenTelemetry's Framework and Deployment Options A recent Tech Talk, ...

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...