Getting Data In

Is it safe to use a 6.5.2 universal forwarder with a 6.5.1 indexer?

New Member

I would like to deploy the latest 64-bit Windows forwarder (6.5.2) but we are still at 6.5.1 for our indexers.

0 Karma

Splunk Employee
Splunk Employee

@broomejohnp - Did one of the answers below help provide a solution your question? If yes, please click “Accept” below the best answer to resolve this post and upvote anything that was helpful. If no, please leave a comment with more feedback. Thanks.

0 Karma

Ultra Champion

As @somesoni2 mentioned its probably best practice to keep everything at the same version, but the important line from the link reads:

A universal forwarder that is version 6.0 or later can send data to a Splunk Enterprise indexer that is version 5.0 or later

In our environment I have several hundred universal forwarders running 6.5.2 forwarding to a 6.5.0 index cluster with no issues.

SplunkTrust
SplunkTrust

It's recommended (for best practices) that indexers should be at same or higher version as the forwarder, for best results, but since both are same major version, I don't see any issues in that. For more info on the restrictions, see this.

http://docs.splunk.com/Documentation/Forwarder/6.5.2/Forwarder/Compatibilitybetweenforwardersandinde...

Ultra Champion

Fascinating -

alt text

0 Karma