What is the UF upgrade compatibility?

[jkrehrer22]

I need to upgrade a several forwarders that are running older versions such as 4.x and 5.x. to 7.x.

Our distributed environment is running at 7.1.4.

Do I need to upgrade the UF to 6.5.2 first? Or, can i upgrade straight to 7.1.4?

[sloshburch]

I recommend you do need to upgrade to 6.6 first to be safe.

While there is no declared issue with UF, this IS called out in the Splunk Enterprise manual.

In fact, for those instances older than 6.0 you may need to upgrade to 5 and then 6 and then 6.6 and then 7.3.

If the UF gets all of it's config from the Deployment Server, you may even consider uninstalling the UF and then installing the latest clean.

[pruthvikrishnap]

It completely depends on the version you are using on your indexers.
Below docs can help.
https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Compatibilitybetweenforwardersandinde...

[skalliger]

You can always install the UF version you want to, as long as it's not newer thant the indexer's version . See here. Installing a newer UF is just an uninstall and reinstall or replacing the files.

Be sure to backup your local files in case of a complete uninstall like mentioned here for Windows or here for *NIX. Remember that the loadbalancing for UFs got optimised, take a look here in case you want to change a few things: configure loadbalancing.

Skalli