Getting Data In

Linux servers: After upgrading from 6.2.0 to 7.2.0, will the 6.2.0 universal forwarders be able to communicate with the new 7.0.2 enterprise components?

Path Finder

We are considering upgrading from 6.2.0 to version 7.0.2 All the *nix servers will be upgraded but during the upgrade process, will the 6.2.0 universal forwarders be able to communicate with the new 7.0.2 enterprise components?

Our windows servers won't be updated as we are thinking of removing the clients. Will the 6.2.0 windows universal forwarders still function with 7.0.2?

My understanding is that and enterprise components 7.0.2 should be ok to receive data from any 6.x or higher forwarder

0 Karma

Path Finder

so to get the 6.2.0 windows forwarders that are marked for decommission working with the new 7.0.2 enterprise components my understanding is to add the following to the server.conf.

sslVersions = *,-ssl2 
sslVersionsForClient = *,-ssl2 
cipherSuite = TLSv1+HIGH:TLSv1.2+HIGH:@STRENGTH

I also like the idea of doing the UFW 7 installation prior to the enterprise component so less server.conf configurations will be requried to connect.
So end state will be:
windows servers UFW 6.2.0
*nix servers 7.0.2
enterprise components 7.0.2

My understanding is to
1. apply the conf changes to windows,
2. install 7.0.2 UFW on nix
3. Upgrade enterprise components on *nix 7.0.2

Any other gotcha's you can think of?

0 Karma


For the Windows part, i'd take in account how long they will be around. When only a few months then this can be your path, when longer then i'd upgrade the windows ufw as well, to have a clean environment.

0 Karma


One thing ist the part with the SSL:
An indexer that is version 6.6 or later, including 7.0, can receive data from a forwarder that is version 4.3 or later, including 7.0, after you change the SSL/TLS version and cipher suite on the indexer.

You have to change the SSLv3 Support to nil in Forwarders older then 6.4.0, after the POODLE Problem.

Since you have to change your setting, why not first upgrade your forwarders? I have UFW 7 which connects to a 6.6 Indexer.

0 Karma


Hi rlaan,

take a look at the docs here:

I think the following quote is important:
A forwarder that is version 6.0 to 6.5 can send data to an indexer that is version 5.0 or later, but less than 7.0.

0 Karma
Get Updates on the Splunk Community!

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...

Admin Console: A Single, Unified Interface for All Your Cloud Admin Needs

WATCH NOWJoin us to learn how the admin console can save you time and give you more control over the Splunk® ...