Version Compatibility from Universal Forwarder to Heavy Forwarder

[act_waltersj]

I've seen a lot of documents and posts on compatibility between indexers (Idx) and forwarders, but nothing specific on universal forwarders (U-F) to heavy forwarders (H-F).  This is our current architecture with Splunk Enterprise versions:

U-F (6.5)  -->  H-F (7.3)  -->  Idx (7.3)

I need to upgrade to 8.1 Given that indexers can be a higher version than then forwarders, I can update the Idx and the H-F before the U-F's are all upgraded?  Or will the 6.5 vs 8.1 incompatibly affect U-Fs to H-Fs?  If it will, and I need to leave the H-F at 7.3 until the U-F are upgraded, can I have the U-Fs upgraded to 8.1,or will that not work because the U-F would be a higher version than the H-F?

The other option is to upgrade all of the U-F to 7.3, then upgrade them again after the Idx and H-F are upgraded, but I'm trying to avoid having the U-F upgrade done twice.  I also do not have a test or sandbox environment to do any kind of playing around on, so just trying it to see what happens isn't a good option.

[gcusello · Accepted solution]

Hi @act_waltersj,

for my experience, if you haven't metrics on UFs, the UFs 6.x continues to work with Idx 8.x and HFs 8.x.

Splunk doesn'r support this but it should work.

So I think that you can upgrade idx to 8.x, then HFs to 8.x and then UFs to 8.x, so you don't need to upgrade twice.

Ciao.

Giuseppe.