Splunk Indexer and Universal Forwarder version compatibility

[charlescywong]

I noticed that Splunk official suggested us to keep the Indexer and UF using the same version (I am using 6.2.3). However, due to some issue, I need to upgrade the UF to 6.2.6 or 6.3. So doing, any compatibility issue will be introduced?

[acharlieh · Accepted solution]

No. This is spelled out in the docs: http://docs.splunk.com/Documentation/Splunk/6.3.3/Forwarding/Compatibilitybetweenforwardersandindexe...

• A forwarder that runs version 6.x can send data to indexers that run version 5.0.x and later.
• An indexer that runs version 6.x can accept data from forwarders that run version 4.3.x and later.

[charlescywong]

Thanks Acharlieh !!