What is the forwarder to indexer compatibility matrix?

[Simeon]

I have a mixed environment of forwarders and indexers (3.4, 4.0, and 4.1) and I would like to know which versions are supported/compatible with each other. For example, can I run a 3.x forwarder with 4.1 indexer? On the flip side, can I run a 4.1 forwarder with a 4.0 indexer?

[sberg]

So, wait a sec... does a 4.3.3 uni forwarder >> 4.3.2 indexer work?

The 4.3.2 forwarder for windows has a serious bug and I'm trying to figure out if upgrading or downgrading is the best option for the 50+ forwarders I have in use.

The bug... http://splunk-base.splunk.com/answers/47535/wineventlog-on-windows-2008-and-splunk-432-forwarders-sp...

[sberg]

To answer my own question. Yes.

Installed 4.3.4 universal forwarder (x64 variety on WinServer2008) and all is well reporting to 4.3.2 indexer.

[gkanapathy]

Forwarders can always send to newer versions of indexers, as indicated in Simeon's answer. In addition, all 4.0, 4.1, and 4.2 forwarders can send to any indexer with version 3.4.14 or higher. Thus, any 4.x forwarder can talk to any 4.x indexer (as well as 3.4.14 indexers).

See: http://www.splunk.com/base/Documentation/5.0/Deploy/Enableareceiver#Compatibility_between_forwarders...

[alexander_lucas]

what is the updated case for 4.3?

[kmjefferson42]

Can the latest version of the Universal Forwarder send to older version of Splunk Indexer? Specifically v5.6??
I would not think there would be a problem but need to verify.

Thank you,

[Simeon · Accepted solution]

Splunk indexers are backwards compatible with older versions of the forwarder. However, Splunk forwarders are not backwards compatible with older versions of the indexer. For example, the following environments are supported:

3.4 Splunk Forwarder >> 4.0 Splunk Indexer
4.0 Splunk Forwarder >> 4.1 Splunk Indexer
3.4 Splunk Forwarder >> 4.1 Splunk Indexer

[bwooden]

6.0 update from http://docs.splunk.com/Documentation/Splunk/6.0/Forwarding/Compatibilitybetweenforwardersandindexers

• 6.0 forwarders (universal/light/heavy) are backwards compatible down to 4.2+ indexers. For example, a 6.0 forwarder can send data to a 4.2 indexer but not to a 4.1 indexer.
• 6.0 indexers are backwards compatible with forwarders down to 4.x.

The following 6.0 features are available only if both indexers and forwarders are at version 6.0 or higher:
* Dynamic file headers
* Timezone extraction on the forwarder

[Jon_Webster]

To be clear and make it easy, text below is from gkanapahty's link above:

4.2+/5.0+ forwarders (universal/light/heavy) are backwards compatible down to 4.2+ indexers. For example, a 4.3 forwarder can send data to a 4.2 indexer but not to a 4.1 indexer. 

Pre-4.2 forwarders are backwards compatible down to 4.0 indexers. 

All indexers are backwards compatible with any forwarder and can receive data from any earlier version forwarder. For example, a 4.2 indexer can receive data from a 4.1 forwarder.

[gkanapathy]

This information is no longer valid. The compatibility matrix has been expanded. See http://www.splunk.com/base/Documentation/5.0/Deploy/Enableareceiver#Compatibility_between_forwarders...