Does Splunk Forwarder 10.2 really require AVX?

[mpavlas]

Hi,
we are upgrading our Splunk to version 10.2 and one of Forwarders refused to update because of:

* Active KVStore version upgrade precheck PASSED
* CPU Info upgrade precheck FAILED!
--
This check is to ensure that Splunk is running on supported CPU with required microarchitecture and instruction sets enabled.
--
CPU Details:
CPU Vendor: GenuineIntel
CPU Brand: \x

Missing Requirements:
- CPU missing required AVX instruction set for Intel processors

In order to fix this failed check follow the 'System requirements for use of Splunk Enterprise on-premises' documentation: https://docs.splunk.com/Documentation/Splunk/latest/Installation/Systemrequirements
If you are absolutely certain that your system meets the requirements, try setting the SPLUNK_SKIP_PREINSTALL_CPU_CHECKS_CORRUPTING_DATA_IF_UNSUPPORTED environment variable to 1.

It's Intel(R) Pentium(R) CPU 6405U so it doesn't have the AVX instructions.
I'm not sure if KVStore is actually used by Splunk Forwarder at all.
Can somebody confirm or deny if I can use the SPLUNK_SKIP_PREINSTALL_CPU_CHECKS_CORRUPTING_DATA_IF_UNSUPPORTED variable?

[PickleRick · Accepted solution]

Universal Forwarders don't run kvstore.

A Heavy Forwarder is simply a full Splunk Enterprise instance with local indexing disabled. The official requirements for Splunk Enterprise include AVX. You might get away with running such HF with kvstore disabled if your inputs do not require it but it would be an completely unsupported setup.

Anyway, why would you upgrade such an ancient machine to most recent version? Just leave it as it is. HFs do not have to match the rest of the environment version-wise.

[mpavlas]

Just to be clear - this is about Universal Forwarder, not the Heavy one.
The Launch Date of 6405U was Q4'19. It's not ancient. We would have bought the i3 if we had known this would happen.
We have to maintain security updates to pass authorized Nessus scans and it's not long time ago when there was PostgreSQL binary with known issues even in splunkforwarder package. It's just better to keep all things up to date for us.

[PickleRick]

Ahhh, right. It's a Pentium. It's never been meant for serious workload so running Splunk Enterprise on it would be unwise anyway.

But UF does not - as I said - run kvstore and it's not supposed to check for it. If it does it seems to be an overlook (as well as on the documentation team part because the forwarder docs link to Splunk Enterprise docs on kvstore).

And let me not speak my mind again about "vulnerability management" by "run Nessus and then panic".