What is the correct upgrade order- Forwarders first or last?

[Myelin]

Hello. In our currently Splunk deployment we have a mix 4.2.* and 4.3.* boxes and are planning an upgrade to Splunk 6. Should the forwarders be upgraded before or after the Indexers, Search Heads, Deploy box.

For example should our path be:

1) Forwarders from 4.2 -> 4.3

2) Indexers, Search Heads, Deploy Server 4.2 -> 4.3

3) Forwarders from 4.3 -> 6.0

4) Indexers, Search Heads, Deploy Server 4.3 -> 6.0

OR

1) Indexers, Search Heads, Deploy Server 4.2 -> 4.3

2) Forwarders from 4.2 -> 4.3

3) Indexers, Search Heads, Deploy Server 4.3 -> 6.0

4) Forwarders from 4.3 -> 6.0

[jmulcaster_splu]

Here are some doc links you can refer to that can help you map compatibility among forwarders and indexers. Remember, always refer to the documentation for the version you are upgrading to. The links below point to the latest version of the Splunk Enterprise docs, but if you're upgrading to a version that is not the latest, use the version drop-down in the docs to find the instructions for the Splunk Enterprise version you're upgrading to.

Compatibility between forwarders and Splunk Enterprise indexers
Distributed search: Compatibility between search heads and search peers

To determine whether you need to do a two-step upgrade to skip versions, see Upgrade paths to version (latest).

A detail to pay attention to is the compatibility of cipher suites among the different versions. See the documentation for instructions about how to Configure secure communications between Splunk instances with updated cipher suite and message authe....

These links and more, along with a roadmap overview of the upgrade process and order of operations, are in the post What's the order of operations for upgrading Splunk Enterprise?

[masonmorales]

You may want to double-check with Splunk Support, but I think this path would work for you:

1) Indexers, Search Heads, Deploy Server 4.2 -> 5.0.16
2) Forwarders from 4.2 -> 5.0.16
2) Indexers, Search Heads, Deploy Server 5.0.16 -> 6.4.2
3) Forwarders from 5.0.16 -> 6.4.2

[wit]

I have Indexer version 6.3.3. Is it compatible with Forwarder 6.4?

[dveuve_splunk]

Here is the updated doc:

http://docs.splunk.com/Documentation/Splunk/6.0/Forwarding/Compatibilitybetweenforwardersandindexers

These are the specific version compatibility restrictions between forwarders and their receiving indexers:
6.x forwarders (universal/light/heavy) are backwards compatible down to 5.0.x indexers.
6.x indexers are backwards compatible with forwarders down to 5.0.x.