Getting Data In

What is the forwarder to indexer compatibility matrix?

Simeon
Splunk Employee
Splunk Employee

I have a mixed environment of forwarders and indexers (3.4, 4.0, and 4.1) and I would like to know which versions are supported/compatible with each other. For example, can I run a 3.x forwarder with 4.1 indexer? On the flip side, can I run a 4.1 forwarder with a 4.0 indexer?

1 Solution

Simeon
Splunk Employee
Splunk Employee

Splunk indexers are backwards compatible with older versions of the forwarder. However, Splunk forwarders are not backwards compatible with older versions of the indexer. For example, the following environments are supported:

3.4 Splunk Forwarder >> 4.0 Splunk Indexer
4.0 Splunk Forwarder >> 4.1 Splunk Indexer
3.4 Splunk Forwarder >> 4.1 Splunk Indexer

View solution in original post

sberg
Explorer

So, wait a sec... does a 4.3.3 uni forwarder >> 4.3.2 indexer work?

The 4.3.2 forwarder for windows has a serious bug and I'm trying to figure out if upgrading or downgrading is the best option for the 50+ forwarders I have in use.

The bug... http://splunk-base.splunk.com/answers/47535/wineventlog-on-windows-2008-and-splunk-432-forwarders-sp...

0 Karma

sberg
Explorer

To answer my own question. Yes.

Installed 4.3.4 universal forwarder (x64 variety on WinServer2008) and all is well reporting to 4.3.2 indexer.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

Forwarders can always send to newer versions of indexers, as indicated in Simeon's answer. In addition, all 4.0, 4.1, and 4.2 forwarders can send to any indexer with version 3.4.14 or higher. Thus, any 4.x forwarder can talk to any 4.x indexer (as well as 3.4.14 indexers).

See: http://www.splunk.com/base/Documentation/5.0/Deploy/Enableareceiver#Compatibility_between_forwarders...

alexander_lucas
Explorer

what is the updated case for 4.3?

0 Karma

kmjefferson42
Explorer

Can the latest version of the Universal Forwarder send to older version of Splunk Indexer? Specifically v5.6??
I would not think there would be a problem but need to verify.

Thank you,

0 Karma

Simeon
Splunk Employee
Splunk Employee

Splunk indexers are backwards compatible with older versions of the forwarder. However, Splunk forwarders are not backwards compatible with older versions of the indexer. For example, the following environments are supported:

3.4 Splunk Forwarder >> 4.0 Splunk Indexer
4.0 Splunk Forwarder >> 4.1 Splunk Indexer
3.4 Splunk Forwarder >> 4.1 Splunk Indexer

bwooden
Splunk Employee
Splunk Employee

6.0 update from http://docs.splunk.com/Documentation/Splunk/6.0/Forwarding/Compatibilitybetweenforwardersandindexers

  • 6.0 forwarders (universal/light/heavy) are backwards compatible down to 4.2+ indexers. For example, a 6.0 forwarder can send data to a 4.2 indexer but not to a 4.1 indexer.
  • 6.0 indexers are backwards compatible with forwarders down to 4.x.

The following 6.0 features are available only if both indexers and forwarders are at version 6.0 or higher:
* Dynamic file headers
* Timezone extraction on the forwarder

0 Karma

Jon_Webster
Splunk Employee
Splunk Employee

To be clear and make it easy, text below is from gkanapahty's link above:

4.2+/5.0+ forwarders (universal/light/heavy) are backwards compatible down to 4.2+ indexers. For example, a 4.3 forwarder can send data to a 4.2 indexer but not to a 4.1 indexer. 

Pre-4.2 forwarders are backwards compatible down to 4.0 indexers. 

All indexers are backwards compatible with any forwarder and can receive data from any earlier version forwarder. For example, a 4.2 indexer can receive data from a 4.1 forwarder.
0 Karma

gkanapathy
Splunk Employee
Splunk Employee

This information is no longer valid. The compatibility matrix has been expanded. See http://www.splunk.com/base/Documentation/5.0/Deploy/Enableareceiver#Compatibility_between_forwarders...

Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...