Universal Forwarder

[steve32507]

How do I remediate this vulnerability?

Tenable 164078 

Upgrade Splunk Enterprise or Universal Forwarder to version 9.0 or later.

[gcusello]

Hi @steve32507,

could you better describe your question? it isn't readable.

Ciao.

Giuseppe

[steve32507]

How do I upgrade Splunk Enterprise & Universal Forwarder to 9.0 or higher?

[gcusello]

Hi @steve32507,

what's your version?
anyway, here youcan find the upgrade procedure for Splunk Enterprise.

and here you can find the Universal Forwarders upgrade https://docs.splunk.com/Documentation/Splunk/9.1.2/Installation/HowtoupgradeSplunk  procedure https://docs.splunk.com/Documentation/Forwarder/9.1.2/Forwarder/Upgradetheuniversalforwarder 

The steps depend on the starting version.

Ciao.

Giuseppe

[steve32507]

Thank you, have a good day!

[isoutamo]

Hi

you should remember that to getting supported state on your environment your Splunk server (and if you have heavy forwarders between UFs and Splunk servers) must be at least the same level than your UFs will be. In practically this means that you must 1st update your Splunk Server version to the same level where you are planning to upgrade your UFs.

r. Ismo

[steve32507]

Thank you, I will have to check the versions of each

[PickleRick]

Luckily, the requirements are not that strict.

https://docs.splunk.com/Documentation/VersionCompatibility/current/Matrix/Compatibilitybetweenforwar...

I ran successfully 9.0 forwarders with 8.2 indexers for some time since the client's policy was to install the latest available UF.

But while the s2s protocol is not that often upgraded (and even so, the components can negotiate a lower version if one of the connection sides doesn't support the most recent version), there are some issues which can happen if you're using UF with a newer version than your indexers - in case of 9.0 forwarders it was that the forwarders generated events for the _configtracker index which did not exist on the indexers. But it was a minor annoyance, not a real problem.

[steve32507]

Good news, thanks for sharing

[gcusello]

Hi @steve32507,

good for you, see next time!

let me know if I can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉