Here are some doc links you can refer to that can help you map compatibility among forwarders and indexers. Remember, always refer to the documentation for the version you are upgrading to. The links below point to the latest version of the Splunk Enterprise docs, but if you're upgrading to a version that is not the latest, use the version drop-down in the docs to find the instructions for the Splunk Enterprise version you're upgrading to. Compatibility between forwarders and Splunk Enterprise indexers Distributed search: Compatibility between search heads and search peers To determine whether you need to do a two-step upgrade to skip versions, see Upgrade paths to version (latest). A detail to pay attention to is the compatibility of cipher suites among the different versions. See the documentation for instructions about how to Configure secure communications between Splunk instances with updated cipher suite and message authentication code. These links and more, along with a roadmap overview of the upgrade process and order of operations, are in the post What's the order of operations for upgrading Splunk Enterprise? ... View more

Hi, I am now looking for the same thing like you did a long time ago. I want to find out which hosts have been added to Splunk in 2016, just to do a documentation of our data onboarding process. My idea was something like this: | metadata type=sourcetypes |convert ctime(firstTime) AS input_time |convert ctime(lastTime) AS last_event_time |where firstTime>1451606400 AND firstTime<1483228800 Is the metadata affected by the retention policy of an index? For example retention time is set to 180days so firstTime will not be older than 180d max? I checked this, some sourcetypes have events that are older than 2015. But the oldest/earliest event of sourcetype=opsec is just 10 days ago but we did the data input at the beginning of 2016. Are there some reasons why |metadata would not work always? ... View more