Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Universal Forwarder and forward-compatibility
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
In our zest to upgrade our Universal Forwarders (UF) , we have seemed to inadvertently upgrade to a version newer than our indexer. We currently are running Splunk Version 6.4.4. The UF on some of the servers are now at 6.5.
With the best practices stating that it is "recommended that that indexers be at the same or higher version of Splunk Enterprise than the forwarders they are receiving data from," will we see any issues?
When they say same version, are they talking just the major or both major and minor releases?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
With Forwarders, you generally only have to worry about major versions matching to the indexers (e.g., 6.X to 6.X), especially when looking only at data output from the Forwarder.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I would say that they clearly mean "both" HOWEVER, as long as you do not turn on any new features, you should be just fine. I would not change ANYTHING else until you get the Indexers ahead of all forwarders. One of the big problems that you have right now is if you change something and something breaks and it is related to the Forwarders at all, you are going to get tremendous grief (and quote possibly a 'call us back after you upgrade your Indexers' response) from Splunk Support because you are not in a supported configuration.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
With Forwarders, you generally only have to worry about major versions matching to the indexers (e.g., 6.X to 6.X), especially when looking only at data output from the Forwarder.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Modernize your Splunk Apps – Introducing Python 3.13 in Splunk
Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...
SplunkTrust Application Period is Officially OPEN!
