Splunk UF Version Compatibility

[RAVISHANKAR]

Hi Team,

Planned to upgrade Splunk Enterprise from Version 9.2.1 to 9.4.2 Latest - Currently my Splunk UF version is 8.0.5.

Will 8.0.5 support or i need to upgrade UF version too?

Compatibility between forwarders and Splunk Enterprise indexers - Splunk Documentation

It says UF 8.0.X will be compatible for 9.4.X (E,M) Events and metrics.

Need further clarification on this whether i should upgrade UF or it's ok to be on 8.0.X version.

Thanks

[PickleRick]

As always - there are two questions.

1. Will it run? Probably. I've worked with 9.0 Splunk servers supplied with UFs going as far back as 6.6.x.

2. Is it a good idea? Depends on the circumstances. As the others already said - if you have no other choice, you're running what you have. But it's usually better to upgrade (unless there are some critical bugs affecting your particular use case). If not for any other reason - 9.0 introduced configuration tracking so you can see what changed and when.

[isoutamo]

As already said technically you could use quite old UF with new splunk IHF/Server version. BUT you must understand that there are several improvements and also many security issues fixed on newer UF versions. 

Of course if you have some ancient OS versions then you cannot upgrade UF on those, but then you should also consider to update those OS too.

[livehybrid]

Hi @RAVISHANKAR 

Whilst you are right in that the 8.0.x UF forward can send events/metrics to 9.4.x it is important to note that 8.0.x UFs are no longer supported by Splunk. So technically, yes, it will work - but from a support standpoint you need to upgrade UFs to 9.1.x to still be supported by Splunk, although that is only until 28th June (17 days!) so I would recommend a minimum of 9.2.x

For more info on supported Splunk versions check out https://www.splunk.com/en_us/legal/splunk-software-support-policy.html?locale=en_us

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing