Getting Data In

Is it safe to use a 6.5.2 universal forwarder with a 6.5.1 indexer?

broomejohnp
New Member

I would like to deploy the latest 64-bit Windows forwarder (6.5.2) but we are still at 6.5.1 for our indexers.

0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

@broomejohnp - Did one of the answers below help provide a solution your question? If yes, please click “Accept” below the best answer to resolve this post and upvote anything that was helpful. If no, please leave a comment with more feedback. Thanks.

0 Karma

nickhills
Ultra Champion

As @somesoni2 mentioned its probably best practice to keep everything at the same version, but the important line from the link reads:

A universal forwarder that is version 6.0 or later can send data to a Splunk Enterprise indexer that is version 5.0 or later

In our environment I have several hundred universal forwarders running 6.5.2 forwarding to a 6.5.0 index cluster with no issues.

If my comment helps, please give it a thumbs up!

somesoni2
Revered Legend

It's recommended (for best practices) that indexers should be at same or higher version as the forwarder, for best results, but since both are same major version, I don't see any issues in that. For more info on the restrictions, see this.

http://docs.splunk.com/Documentation/Forwarder/6.5.2/Forwarder/Compatibilitybetweenforwardersandinde...

ddrillic
Ultra Champion

Fascinating -

alt text

0 Karma
Get Updates on the Splunk Community!

Detecting Brute Force Account Takeover Fraud with Splunk

This article is the second in a three-part series exploring advanced fraud detection techniques using Splunk. ...

Buttercup Games: Further Dashboarding Techniques (Part 9)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Buttercup Games: Further Dashboarding Techniques (Part 8)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...