Getting Data In

Universal Forwarder 8.0 upgrade path from 6.x

smiejascott
New Member

We have a bunch of older 6.x universal forwarders that will be incompatible with an 8.0 Enterprise Splunk instance. Is there any reason I can't upgrade these directly to 8.0 or do they need to be upgraded to 7.x first? The upgrade documentation isn't really clear.

In my mind I can't see any reason that an intermediate upgrade would be needed for a UF, but I suppose there could be one.

0 Karma
1 Solution

burwell
SplunkTrust
SplunkTrust

Hi. You should read https://docs.splunk.com/Documentation/Splunk/8.0.1/Installation/AboutupgradingREADTHISFIRST

This clearly says don't go from 6.x to 8.x universal forwarder. You need to go to version 7 first.

View solution in original post

burwell
SplunkTrust
SplunkTrust

Hi. You should read https://docs.splunk.com/Documentation/Splunk/8.0.1/Installation/AboutupgradingREADTHISFIRST

This clearly says don't go from 6.x to 8.x universal forwarder. You need to go to version 7 first.

burwell
SplunkTrust
SplunkTrust

@smiejascott Hi so be clear: This sentence was in the above docs.

Do not try to upgrade Splunk Enterprise or Splunk universal forwarders directly to version 8.0 from a version that is lower than 7.0.

smiejascott
New Member

Got it. I had always figured that the UFs were pretty simplistic but obviously something else is going on.

0 Karma

burwell
SplunkTrust
SplunkTrust

Great @smiejascott Want to accept the answer?

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...