Universal Forwarder version 9 issues with 8.2.7 indexers and forwarders?

[ITSplunk117]

Hello,

We're looking to upgrade our universal forwarder to version 9.x and since I haven't found anything definitive yet I wanted to ask on here if there's any issues, I should be aware of with UF v9.x and v. 8.2.7 indexers and forwarders.

thanks

[ITSplunk117]

Thank you,
I have seen that page, wondering if there was any more detailed document(s) about compatibility issues.  Was told to research this and just have to try looking into it further.

[gcusello]

Hi @ITSplunk117,

in tis page it's described the compatibility map between Indexers and Forwarders https://docs.splunk.com/Documentation/VersionCompatibility/current/Matrix/Compatibilitybetweenforwar... and it seems that it's possible to have an higher version of the Forwarder than the Indexer, and probably they will run.

But it's also written: "As a best practice, forwarders should communicate with indexers that are the same or higher version."

As me and @richgalloway said.

Ciao.

Giuseppe

[gcusello · Accepted solution]

Hi @ITSplunk117 ,

as @richgalloway said, it's always a best practice to have on the Indexers the same or higher version of the Forwarders, so, don't upgrade your Forwarders until you upgraded Indexers.

About know issue, there isn't anything about the required upgrade.

Ciao.

Giuseppe

[ITSplunk117]

That'll work for me thank you.

[richgalloway]

I prefer to keep each tier at a lower-or-equal version than the higher tier, but that's not much of a factor with UFs.  Have you seen https://docs.splunk.com/Documentation/VersionCompatibility/current/Matrix/Compatibilitybetweenforwar... ?