When is it necessary to upgrade universal forwarders?

[teddyidc1101]

We are planning to upgrade our splunk instances and we are wondering if its necessary for the forwarders as well? if not, then when?
both are running in Splunk 7.0 and environment is distributed, clustered indexers.

[ddrillic]

Only if you need new features which don't exist in your current forwarder. Support sends the message that almost all older versions are supported.

[renjith_nair]

@teddyidc1101 ,

There are different reason why you want to upgrade your forwarders

• Version compatibility - If you are using same version for all the components, then it should be fine for you. However, check this link Compatibility between forwarders and indexers
• Security Updates if there are any - Splunk securityportal announcements
• New feature update or bug fixes - Release Notes