Security

Universal Forwarder

steve32507
Observer

How do I remediate this vulnerability?

Tenable 164078 

Upgrade Splunk Enterprise or Universal Forwarder to version 9.0 or later.
Labels (1)
Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @steve32507,

could you better describe your question? it isn't readable.

Ciao.

Giuseppe

0 Karma

steve32507
Observer

How do I upgrade Splunk Enterprise & Universal Forwarder to 9.0 or higher?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @steve32507,

what's your version?
anyway, here youcan find the upgrade procedure for Splunk Enterprise.

and here you can find the Universal Forwarders upgrade https://docs.splunk.com/Documentation/Splunk/9.1.2/Installation/HowtoupgradeSplunk  procedure https://docs.splunk.com/Documentation/Forwarder/9.1.2/Forwarder/Upgradetheuniversalforwarder 

The steps depend on the starting version.

Ciao.

Giuseppe

0 Karma

steve32507
Observer

Thank you, have a good day!

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

you should remember that to getting supported state on your environment your Splunk server (and if you have heavy forwarders between UFs and Splunk servers) must be at least the same level than your UFs will be. In practically this means that you must 1st update your Splunk Server version to the same level where you are planning to upgrade your UFs.

r. Ismo

0 Karma

steve32507
Observer

Thank you, I will have to check the versions of each

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Luckily, the requirements are not that strict.

https://docs.splunk.com/Documentation/VersionCompatibility/current/Matrix/Compatibilitybetweenforwar...

I ran successfully 9.0 forwarders with 8.2 indexers for some time since the client's policy was to install the latest available UF.

But while the s2s protocol is not that often upgraded (and even so, the components can negotiate a lower version if one of the connection sides doesn't support the most recent version), there are some issues which can happen if you're using UF with a newer version than your indexers - in case of 9.0 forwarders it was that the forwarders generated events for the _configtracker index which did not exist on the indexers. But it was a minor annoyance, not a real problem.

0 Karma

steve32507
Observer

Good news, thanks for sharing

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @steve32507,

good for you, see next time!

let me know if I can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...