When upgrading forwarders to 6.4.2 is it best to just upgrade or uninstall and reinstall?

[heats]

We will be upgrading all of our forwarders to 6.4.2. Is the best practice to do an upgrade or to uninstall and reinstall?

[ddrillic · Accepted solution]

The best practice is to install on top of the existing installation.

https://docs.splunk.com/Documentation/Forwarder/6.5.1/Forwarder/Upgradethenixuniversalforwarder

It says -

Btw, why not to the latest 6.5.x version?

[burwell]

You will want your heads and indexers to be at or exceed your forwarder version, by the way.

[heats]

University fun! We're transitioning our Splunk service to a central service and they're only at 6.4.2. Womp womp! Thank you ddrillic!