Splunk Enterprise

Splunk UF Version Compatibility

RAVISHANKAR
Loves-to-Learn Lots

Hi Team,

Planned to upgrade Splunk Enterprise from Version 9.2.1 to 9.4.2 Latest - Currently my Splunk UF version is 8.0.5.

Will 8.0.5 support or i need to upgrade UF version too?

Compatibility between forwarders and Splunk Enterprise indexers - Splunk Documentation

It says UF 8.0.X will be compatible for 9.4.X (E,M) Events and metrics.

Need further clarification on this whether i should upgrade UF or it's ok to be on 8.0.X version.

Thanks

 

Labels (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

As always - there are two questions.

1. Will it run? Probably. I've worked with 9.0 Splunk servers supplied with UFs going as far back as 6.6.x.

2. Is it a good idea? Depends on the circumstances. As the others already said - if you have no other choice, you're running what you have. But it's usually better to upgrade (unless there are some critical bugs affecting your particular use case). If not for any other reason - 9.0 introduced configuration tracking so you can see what changed and when.

0 Karma

isoutamo
SplunkTrust
SplunkTrust

As already said technically you could use quite old UF with new splunk IHF/Server version. BUT you must understand that there are several improvements and also many security issues fixed on newer UF versions. 

Of course if you have some ancient OS versions then you cannot upgrade UF on those, but then you should also consider to update those OS too.

0 Karma

livehybrid
Super Champion

Hi @RAVISHANKAR 

Whilst you are right in that the 8.0.x UF forward can send events/metrics to 9.4.x it is important to note that 8.0.x UFs are no longer supported by Splunk. So technically, yes, it will work - but from a support standpoint you need to upgrade UFs to 9.1.x to still be supported by Splunk, although that is only until 28th June (17 days!) so I would recommend a minimum of 9.2.x

For more info on supported Splunk versions check out https://www.splunk.com/en_us/legal/splunk-software-support-policy.html?locale=en_us

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

 

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...