We will be upgrading all of our forwarders to 6.4.2. Is the best practice to do an upgrade or to uninstall and reinstall?
The best practice is to install on top of the existing installation.
It says -
Btw, why not to the latest 6.5.x version?
View solution in original post
You will want your heads and indexers to be at or exceed your forwarder version, by the way.
University fun! We're transitioning our Splunk service to a central service and they're only at 6.4.2. Womp womp! Thank you ddrillic!