Getting Data In

Linux servers: After upgrading from 6.2.0 to 7.2.0, will the 6.2.0 universal forwarders be able to communicate with the new 7.0.2 enterprise components?

rlaan
Path Finder

We are considering upgrading from 6.2.0 to version 7.0.2 All the *nix servers will be upgraded but during the upgrade process, will the 6.2.0 universal forwarders be able to communicate with the new 7.0.2 enterprise components?

Our windows servers won't be updated as we are thinking of removing the clients. Will the 6.2.0 windows universal forwarders still function with 7.0.2?

My understanding is that and enterprise components 7.0.2 should be ok to receive data from any 6.x or higher forwarder

0 Karma

rlaan
Path Finder

so to get the 6.2.0 windows forwarders that are marked for decommission working with the new 7.0.2 enterprise components my understanding is to add the following to the server.conf.

[sslConfig] 
sslVersions = *,-ssl2 
sslVersionsForClient = *,-ssl2 
cipherSuite = TLSv1+HIGH:TLSv1.2+HIGH:@STRENGTH

I also like the idea of doing the UFW 7 installation prior to the enterprise component so less server.conf configurations will be requried to connect.
So end state will be:
windows servers UFW 6.2.0
*nix servers 7.0.2
enterprise components 7.0.2

My understanding is to
1. apply the conf changes to windows,
2. install 7.0.2 UFW on nix
3. Upgrade enterprise components on *nix 7.0.2

Any other gotcha's you can think of?

0 Karma

Elsurion
Communicator

For the Windows part, i'd take in account how long they will be around. When only a few months then this can be your path, when longer then i'd upgrade the windows ufw as well, to have a clean environment.

0 Karma

Elsurion
Communicator

One thing ist the part with the SSL:
An indexer that is version 6.6 or later, including 7.0, can receive data from a forwarder that is version 4.3 or later, including 7.0, after you change the SSL/TLS version and cipher suite on the indexer.
https://docs.splunk.com/Documentation/Splunk/7.0.2/Forwarding/Compatibilitybetweenforwardersandindex...

You have to change the SSLv3 Support to nil in Forwarders older then 6.4.0, after the POODLE Problem.

Since you have to change your setting, why not first upgrade your forwarders? I have UFW 7 which connects to a 6.6 Indexer.

0 Karma

horsefez
Motivator

Hi rlaan,

take a look at the docs here:
https://docs.splunk.com/Documentation/Splunk/7.0.2/Forwarding/Compatibilitybetweenforwardersandindex...

I think the following quote is important:
A forwarder that is version 6.0 to 6.5 can send data to an indexer that is version 5.0 or later, but less than 7.0.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...