Getting Data In

Why am I not receiving events from Splunk 7.3.1 UF to Splunk 8.2.1 Indexer?

khin
Explorer

Hi, I have a mixed version splunk deployment which involves one indexer of 8.2.1 and another of 7.3.1. There are also 3 Heavy Forwarders linked to one another to reach indexers. Here are the versions:

  1. Indexer 01 - 8.2.1
  2. Indexer 02 - 7.3.1.1
  3. 2HFs - 7.3.1.1
  4. 1HF - 8.21.
  5. 1UF - 7.3.1

This is how the data from UF is forwarded to indexers.

UF -> 7.3.1.1 HF -> 7.3.1.1 HF -> Indexer 02, UF-> 7.3.1.1 HF -> 7.3.1.1 HF -> 8.2.1 HF -> Indexer01

Both indexers can receive _internal logs from all UF and HFs, but only Indexer 02 (7.3.1.1) can receive main and other custom indexes.

This is the concern.  I should be able to receive events from 7.3.1 UF in 8.2.1 Indexer according to this . It mentions 7.3.1 and 8.2.1 are compatible but limited support. What does it mean by limited support? 

What I have tested so far is that, fully 7.3.1 environment and fully 8.2.1 environment can receive custom logs from UF, but the mixed one hasn't worked yet. Is there anything I must have missed out?

Thank you and much appreciated!

 

 

Labels (3)
0 Karma
1 Solution

khin
Explorer

This was solved by configuring the outputs.conf properly.

The second 7.3.1.1 HF (outputs.conf)

[tcpout]
defaultGroup = indexer01, indexer02
[tcpout:indexer01]
server=indexer01_IP
[tcpout:indexer02]
server=indexer02_IP

 

 

View solution in original post

0 Karma

khin
Explorer

This was solved by configuring the outputs.conf properly.

The second 7.3.1.1 HF (outputs.conf)

[tcpout]
defaultGroup = indexer01, indexer02
[tcpout:indexer01]
server=indexer01_IP
[tcpout:indexer02]
server=indexer02_IP

 

 

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...