Getting Data In

Is it safe to use a 6.5.2 universal forwarder with a 6.5.1 indexer?

New Member

I would like to deploy the latest 64-bit Windows forwarder (6.5.2) but we are still at 6.5.1 for our indexers.

0 Karma

Splunk Employee
Splunk Employee

@broomejohnp - Did one of the answers below help provide a solution your question? If yes, please click “Accept” below the best answer to resolve this post and upvote anything that was helpful. If no, please leave a comment with more feedback. Thanks.

0 Karma

Ultra Champion

As @somesoni2 mentioned its probably best practice to keep everything at the same version, but the important line from the link reads:

A universal forwarder that is version 6.0 or later can send data to a Splunk Enterprise indexer that is version 5.0 or later

In our environment I have several hundred universal forwarders running 6.5.2 forwarding to a 6.5.0 index cluster with no issues.

If my comment helps, please give it a thumbs up!

Revered Legend

It's recommended (for best practices) that indexers should be at same or higher version as the forwarder, for best results, but since both are same major version, I don't see any issues in that. For more info on the restrictions, see this.

Ultra Champion

Fascinating -

alt text

0 Karma
Get Updates on the Splunk Community!

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...

There's No Place Like Chrome and the Splunk Platform

WATCH NOW!Malware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

Customer Experience | Join the Customer Advisory Board!

Are you ready to take your Splunk journey to the next level? 🚀 We invite you to join our elite squad ...