So I would like to deploy the Splunk Universal Forwarder to our Windows 7 client estate and noticed the latest supported version is 6.4.9.
My question: is this version still supported by Splunk? i.e can I still raise support tickets via our Splunk support agreement if I run into problems?
The Splunk Software Support Policy states: "Splunk provides full Support, including, when available, updates, bug fixes and maintenance releases for twenty-four (24) months from the then-current major or minor release in accordance with Splunk’s Support Terms and Conditions. For example, Splunk will support Splunk Enterprise 7.0 for 2 years after Splunk Enterprise 7.0 is released and when 7.1 is released, 7.1 will be supported for two years from the date of that release. Similarly, Splunk will support Splunk IT Service Intelligence 2.6.1 for 2 years after Splunk IT Service Intelligence 2.6.0 was released."
Splunk Enterprise and the Splunk Universal Forwarder, version 6.4.0, were released on April 5, 2016, as mentioned in the Release Notes.
So your version of the universal forwarder will continue to be supported until April 5, 2018 (about six weeks from now).
Thanks for the quick response ChrisG..
So if I was to deploy this version (as upgrade to later Windows OS will probably take some time), are Splunk likely to provide a "best endeavours" support approach or is it pretty black and white, where we're unlikely to get assistance until we upgrade the UF version?
I'm not on the Customer Support team, so I don't want to speak for them. My suggestion is that you call them and ask them directly, since right now you have an active support contract and are using currently-supported software.