I would like to deploy the latest 64-bit Windows forwarder (6.5.2) but we are still at 6.5.1 for our indexers.
@broomejohnp - Did one of the answers below help provide a solution your question? If yes, please click “Accept” below the best answer to resolve this post and upvote anything that was helpful. If no, please leave a comment with more feedback. Thanks.
As @somesoni2 mentioned its probably best practice to keep everything at the same version, but the important line from the link reads:
A universal forwarder that is version 6.0 or later can send data to a Splunk Enterprise indexer that is version 5.0 or later
In our environment I have several hundred universal forwarders running 6.5.2 forwarding to a 6.5.0 index cluster with no issues.
It's recommended (for best practices) that indexers should be at same or higher version as the forwarder, for best results, but since both are same major version, I don't see any issues in that. For more info on the restrictions, see this.