splunk forwarder

[bwenge]

Can 4.2.1 Forwarder send data to 4.1.6 Indexer?

[Steve_G_]

From the online documentation:

"The universal forwarder is backwards compatible with older Splunk indexers. You can forward data to any Splunk indexers, version 3.4.14 or above. "

See:

http://www.splunk.com/base/Documentation/latest/Deploy/Deploymentoverview

[Brian_Osburn]

4.2.1 Forwarder is backwards compatible with 4.1.6 (I ran mine like that for a month or so before upgrading).

[carmackd]

I'm not sure about this arrangement, but in our environment we had 4.2 universal forwarders sending to 4.1.4 indexers.