Splunk universal forwarder upgrade from 4.3.x to 7.0

[ikulcsar]

HI,

I'm looking for information about updating UFs from version 4.3.x to 7.0.
I checked Splunk docs (Forwarder Manual), but there are no version dependency requirements for the upgrade.

So the question: is supported (and safe) the one step upgrade from 4.3.x to 7.0? The conjecture that yes, can someone confirm it?

Regards,
István

[lloydknight · Accepted solution]

Hello ikulcsar

I would highly suggest to download the currently installed 4.3.x as a backup installer in case you would want to revert when an issue arises and backup your current configurations before upgrading.

For some reason (by my experience on installing UFs on different types of OS), I have encountered some version incompatibility issues esp. on AIX and solved some of those by downgrading or upgrading the UF. Also check the release notes of the UF that you will install. After the installation/upgrade, always check splunkd.log for errors.

Hope it helps!

Thanks!