Getting Data In

Linux servers: After upgrading from 6.2.0 to 7.2.0, will the 6.2.0 universal forwarders be able to communicate with the new 7.0.2 enterprise components?

Path Finder

We are considering upgrading from 6.2.0 to version 7.0.2 All the *nix servers will be upgraded but during the upgrade process, will the 6.2.0 universal forwarders be able to communicate with the new 7.0.2 enterprise components?

Our windows servers won't be updated as we are thinking of removing the clients. Will the 6.2.0 windows universal forwarders still function with 7.0.2?

My understanding is that and enterprise components 7.0.2 should be ok to receive data from any 6.x or higher forwarder

0 Karma

Path Finder

so to get the 6.2.0 windows forwarders that are marked for decommission working with the new 7.0.2 enterprise components my understanding is to add the following to the server.conf.

sslVersions = *,-ssl2 
sslVersionsForClient = *,-ssl2 
cipherSuite = TLSv1+HIGH:TLSv1.2+HIGH:@STRENGTH

I also like the idea of doing the UFW 7 installation prior to the enterprise component so less server.conf configurations will be requried to connect.
So end state will be:
windows servers UFW 6.2.0
*nix servers 7.0.2
enterprise components 7.0.2

My understanding is to
1. apply the conf changes to windows,
2. install 7.0.2 UFW on nix
3. Upgrade enterprise components on *nix 7.0.2

Any other gotcha's you can think of?

0 Karma


For the Windows part, i'd take in account how long they will be around. When only a few months then this can be your path, when longer then i'd upgrade the windows ufw as well, to have a clean environment.

0 Karma


One thing ist the part with the SSL:
An indexer that is version 6.6 or later, including 7.0, can receive data from a forwarder that is version 4.3 or later, including 7.0, after you change the SSL/TLS version and cipher suite on the indexer.

You have to change the SSLv3 Support to nil in Forwarders older then 6.4.0, after the POODLE Problem.

Since you have to change your setting, why not first upgrade your forwarders? I have UFW 7 which connects to a 6.6 Indexer.

0 Karma


Hi rlaan,

take a look at the docs here:

I think the following quote is important:
A forwarder that is version 6.0 to 6.5 can send data to an indexer that is version 5.0 or later, but less than 7.0.

0 Karma
Get Updates on the Splunk Community!

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...