We will be upgrading all of our forwarders to 6.4.2. Is the best practice to do an upgrade or to uninstall and reinstall?
The best practice is to install on top of the existing installation.
https://docs.splunk.com/Documentation/Forwarder/6.5.1/Forwarder/Upgradethenixuniversalforwarder
It says -
Btw, why not to the latest 6.5.x version?
The best practice is to install on top of the existing installation.
https://docs.splunk.com/Documentation/Forwarder/6.5.1/Forwarder/Upgradethenixuniversalforwarder
It says -
Btw, why not to the latest 6.5.x version?
You will want your heads and indexers to be at or exceed your forwarder version, by the way.
University fun! We're transitioning our Splunk service to a central service and they're only at 6.4.2. Womp womp! Thank you ddrillic!