Experience with different Universal Forwarder versions

[patrickvanreck]

Hi everybody

I have a couple of questions regarding the compatibility between Splunk Enterprise Server and Universal Forwarders.
This is mainly about the Mac OSX clients, which as everyone knows are always installed with the last OSX when ordering.
Our servers are still on Enterprise Release 8.0.9, but we can't install that version on the Mac OSX 11 clients.

According to Splunk, Universal Forwarder 8.0.9 is not in the compatibility list of OSX 11 clients (only OSX 10.13, 10.14, 10.15). That means you have to install the 8.2.x version. From then on the OSX 11 appears as compatible.

This means that the Universal Forwarder has a higher version installed than the server.However, based on the compatibility list from Splunk (https://docs.splunk.com/Documentation/Forwarder/8.0.9/Forwarder/Compatibilitybetweenforwardersandind...), compatibility would be given.

• Can we install Universal Forwarder 8.0.9 on OSX-11 clients without having problems?
• Or can we install the Universal Forwarder 8.2.1 on the OSX-11 clients without having problems with our Enterprise servers which are still on version 8.0.9?

Many thanks for your hint's

[PickleRick]

As you can see from the table, 8.2.x forwarders should (according to splunk) work with 8.0.x indexers. So I don't see a problem here.