Universal Forwarder 8.0 upgrade path from 6.x

[smiejascott]

We have a bunch of older 6.x universal forwarders that will be incompatible with an 8.0 Enterprise Splunk instance. Is there any reason I can't upgrade these directly to 8.0 or do they need to be upgraded to 7.x first? The upgrade documentation isn't really clear.

In my mind I can't see any reason that an intermediate upgrade would be needed for a UF, but I suppose there could be one.

[burwell · Accepted solution]

Hi. You should read https://docs.splunk.com/Documentation/Splunk/8.0.1/Installation/AboutupgradingREADTHISFIRST

This clearly says don't go from 6.x to 8.x universal forwarder. You need to go to version 7 first.

[burwell]

@smiejascott Hi so be clear: This sentence was in the above docs.

Do not try to upgrade Splunk Enterprise or Splunk universal forwarders directly to version 8.0 from a version that is lower than 7.0.

[smiejascott]

Got it. I had always figured that the UFs were pretty simplistic but obviously something else is going on.

[burwell]

Great @smiejascott Want to accept the answer?