Getting Data In

Linux servers: After upgrading from 6.2.0 to 7.2.0, will the 6.2.0 universal forwarders be able to communicate with the new 7.0.2 enterprise components?

rlaan
Path Finder

We are considering upgrading from 6.2.0 to version 7.0.2 All the *nix servers will be upgraded but during the upgrade process, will the 6.2.0 universal forwarders be able to communicate with the new 7.0.2 enterprise components?

Our windows servers won't be updated as we are thinking of removing the clients. Will the 6.2.0 windows universal forwarders still function with 7.0.2?

My understanding is that and enterprise components 7.0.2 should be ok to receive data from any 6.x or higher forwarder

0 Karma

rlaan
Path Finder

so to get the 6.2.0 windows forwarders that are marked for decommission working with the new 7.0.2 enterprise components my understanding is to add the following to the server.conf.

[sslConfig] 
sslVersions = *,-ssl2 
sslVersionsForClient = *,-ssl2 
cipherSuite = TLSv1+HIGH:TLSv1.2+HIGH:@STRENGTH

I also like the idea of doing the UFW 7 installation prior to the enterprise component so less server.conf configurations will be requried to connect.
So end state will be:
windows servers UFW 6.2.0
*nix servers 7.0.2
enterprise components 7.0.2

My understanding is to
1. apply the conf changes to windows,
2. install 7.0.2 UFW on nix
3. Upgrade enterprise components on *nix 7.0.2

Any other gotcha's you can think of?

0 Karma

Elsurion
Communicator

For the Windows part, i'd take in account how long they will be around. When only a few months then this can be your path, when longer then i'd upgrade the windows ufw as well, to have a clean environment.

0 Karma

Elsurion
Communicator

One thing ist the part with the SSL:
An indexer that is version 6.6 or later, including 7.0, can receive data from a forwarder that is version 4.3 or later, including 7.0, after you change the SSL/TLS version and cipher suite on the indexer.
https://docs.splunk.com/Documentation/Splunk/7.0.2/Forwarding/Compatibilitybetweenforwardersandindex...

You have to change the SSLv3 Support to nil in Forwarders older then 6.4.0, after the POODLE Problem.

Since you have to change your setting, why not first upgrade your forwarders? I have UFW 7 which connects to a 6.6 Indexer.

0 Karma

horsefez
SplunkTrust
SplunkTrust

Hi rlaan,

take a look at the docs here:
https://docs.splunk.com/Documentation/Splunk/7.0.2/Forwarding/Compatibilitybetweenforwardersandindex...

I think the following quote is important:
A forwarder that is version 6.0 to 6.5 can send data to an indexer that is version 5.0 or later, but less than 7.0.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...