Splunk Enterprise

heavy forwarder of higher version than indexers


i have my splunk indexer cluster on 7.3.0 and i am planning to add a new heavy forwarder, can the new HF be the latest version of splunk (8.1.2) or does it need to be the same as the indexer cluster.  Based on what i know, there is not much difference functionally between a HF and indexer and since indexers should always be of the exact same version, i am a bit confused if there will be a version mismatch issue.

I do have an upgrade plan in pipeline which will eventually happen in 1 or 2 months, just wanted to know if the higher version of HF and lower version in indexer cluster would work as an interim solution.

Note: I do use DB connect intensively on the HF.

Did anyone try something like this, were there any issues.

Labels (1)
0 Karma


Hi @soumyasaha25 ,

In HF if you install the Splunk as a higher version like 8.1.2 and if you are installing any addon in that HF which supports only 8 versions. And if you deploy the same addon in indexer it will make an issue. Since the indexer is the lesser version.

Try to maintain the Splunk components in the same version always.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...