heavy forwarder of higher version than indexers

[soumyasaha25]

i have my splunk indexer cluster on 7.3.0 and i am planning to add a new heavy forwarder, can the new HF be the latest version of splunk (8.1.2) or does it need to be the same as the indexer cluster.  Based on what i know, there is not much difference functionally between a HF and indexer and since indexers should always be of the exact same version, i am a bit confused if there will be a version mismatch issue.

I do have an upgrade plan in pipeline which will eventually happen in 1 or 2 months, just wanted to know if the higher version of HF and lower version in indexer cluster would work as an interim solution.

Note: I do use DB connect intensively on the HF.

Did anyone try something like this, were there any issues.

[Vardhan]

Hi @soumyasaha25 ,

In HF if you install the Splunk as a higher version like 8.1.2 and if you are installing any addon in that HF which supports only 8 versions. And if you deploy the same addon in indexer it will make an issue. Since the indexer is the lesser version.

Try to maintain the Splunk components in the same version always.