Getting Data In

Universal Forwarder 8.0 upgrade path from 6.x

smiejascott
New Member

We have a bunch of older 6.x universal forwarders that will be incompatible with an 8.0 Enterprise Splunk instance. Is there any reason I can't upgrade these directly to 8.0 or do they need to be upgraded to 7.x first? The upgrade documentation isn't really clear.

In my mind I can't see any reason that an intermediate upgrade would be needed for a UF, but I suppose there could be one.

0 Karma
1 Solution

burwell
SplunkTrust
SplunkTrust

Hi. You should read https://docs.splunk.com/Documentation/Splunk/8.0.1/Installation/AboutupgradingREADTHISFIRST

This clearly says don't go from 6.x to 8.x universal forwarder. You need to go to version 7 first.

View solution in original post

burwell
SplunkTrust
SplunkTrust

Hi. You should read https://docs.splunk.com/Documentation/Splunk/8.0.1/Installation/AboutupgradingREADTHISFIRST

This clearly says don't go from 6.x to 8.x universal forwarder. You need to go to version 7 first.

burwell
SplunkTrust
SplunkTrust

@smiejascott Hi so be clear: This sentence was in the above docs.

Do not try to upgrade Splunk Enterprise or Splunk universal forwarders directly to version 8.0 from a version that is lower than 7.0.

smiejascott
New Member

Got it. I had always figured that the UFs were pretty simplistic but obviously something else is going on.

0 Karma

burwell
SplunkTrust
SplunkTrust

Great @smiejascott Want to accept the answer?

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...