Getting Data In

Splunk Hadoop Connector: will it work with version 4.x indexers?

the_wolverine
Champion

I realize the Splunk Hadoop Connector requires forwarder version 5.x. Will it work properly if I attempt to forward to 4.x indexers?

Tags (2)
0 Karma
1 Solution

the_wolverine
Champion

Based on this line of documentation, it looks like it is possible to use a 5.x forwarder to send to 4.2.x (and later) indexers.

These are the compatibility restrictions between versions of forwarders and indexers:

4.2+/5.0+ forwarders (universal/light/heavy) are backwards compatible down to 4.2+ indexers. For example, a 4.3 forwarder can send data to a 4.2 indexer but not to a 4.1 indexer.

View solution in original post

0 Karma

the_wolverine
Champion

Based on this line of documentation, it looks like it is possible to use a 5.x forwarder to send to 4.2.x (and later) indexers.

These are the compatibility restrictions between versions of forwarders and indexers:

4.2+/5.0+ forwarders (universal/light/heavy) are backwards compatible down to 4.2+ indexers. For example, a 4.3 forwarder can send data to a 4.2 indexer but not to a 4.1 indexer.

0 Karma

nfilippi_splunk
Splunk Employee
Splunk Employee

To import data from Hadoop HDFS into Splunk, you are correct, it does require Splunk 5.0 or later forwarder, which supports modular inputs.

For indexer/forwarder compatibility, I would refer to the following docs:
http://docs.splunk.com/Documentation/Splunk/5.0.1/Deploy/Enableareceiver#Compatibility_between_forwa...

Get Updates on the Splunk Community!

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...