Installation

What is the correct upgrade order- Forwarders first or last?

Myelin
Explorer

Hello. In our currently Splunk deployment we have a mix 4.2.* and 4.3.* boxes and are planning an upgrade to Splunk 6. Should the forwarders be upgraded before or after the Indexers, Search Heads, Deploy box.

For example should our path be:

1) Forwarders from 4.2 -> 4.3

2) Indexers, Search Heads, Deploy Server 4.2 -> 4.3

3) Forwarders from 4.3 -> 6.0

4) Indexers, Search Heads, Deploy Server 4.3 -> 6.0

OR

1) Indexers, Search Heads, Deploy Server 4.2 -> 4.3

2) Forwarders from 4.2 -> 4.3

3) Indexers, Search Heads, Deploy Server 4.3 -> 6.0

4) Forwarders from 4.3 -> 6.0

Tags (3)

jmulcaster_splu
Splunk Employee
Splunk Employee

Here are some doc links you can refer to that can help you map compatibility among forwarders and indexers. Remember, always refer to the documentation for the version you are upgrading to. The links below point to the latest version of the Splunk Enterprise docs, but if you're upgrading to a version that is not the latest, use the version drop-down in the docs to find the instructions for the Splunk Enterprise version you're upgrading to.

Compatibility between forwarders and Splunk Enterprise indexers
Distributed search: Compatibility between search heads and search peers

To determine whether you need to do a two-step upgrade to skip versions, see Upgrade paths to version (latest).

A detail to pay attention to is the compatibility of cipher suites among the different versions. See the documentation for instructions about how to Configure secure communications between Splunk instances with updated cipher suite and message authe....

These links and more, along with a roadmap overview of the upgrade process and order of operations, are in the post What's the order of operations for upgrading Splunk Enterprise?

masonmorales
Influencer

You may want to double-check with Splunk Support, but I think this path would work for you:

1) Indexers, Search Heads, Deploy Server 4.2 -> 5.0.16
2) Forwarders from 4.2 -> 5.0.16
2) Indexers, Search Heads, Deploy Server 5.0.16 -> 6.4.2
3) Forwarders from 5.0.16 -> 6.4.2

0 Karma

wit
New Member

I have Indexer version 6.3.3. Is it compatible with Forwarder 6.4?

0 Karma

dveuve_splunk
Splunk Employee
Splunk Employee

Here is the updated doc:

http://docs.splunk.com/Documentation/Splunk/6.0/Forwarding/Compatibilitybetweenforwardersandindexers

These are the specific version compatibility restrictions between forwarders and their receiving indexers:
6.x forwarders (universal/light/heavy) are backwards compatible down to 5.0.x indexers.
6.x indexers are backwards compatible with forwarders down to 5.0.x.
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...