I've seen a lot of documents and posts on compatibility between indexers (Idx) and forwarders, but nothing specific on universal forwarders (U-F) to heavy forwarders (H-F).  This is our current architecture with Splunk Enterprise versions: U-F (6.5)  -->  H-F (7.3)  -->  Idx (7.3) I need to upgrade to 8.1 Given that indexers can be a higher version than then forwarders, I can update the Idx and the H-F before the U-F's are all upgraded?  Or will the 6.5 vs 8.1 incompatibly affect U-Fs to H-Fs?  If it will, and I need to leave the H-F at 7.3 until the U-F are upgraded, can I have the U-Fs upgraded to 8.1,or will that not work because the U-F would be a higher version than the H-F? The other option is to upgrade all of the U-F to 7.3, then upgrade them again after the Idx and H-F are upgraded, but I'm trying to avoid having the U-F upgrade done twice.  I also do not have a test or sandbox environment to do any kind of playing around on, so just trying it to see what happens isn't a good option. ... View more

I'm taking over Splunk admin duties from a co-worker that has left the company.  We have a distributed environment setup of two heavy forwarders and four index servers all running  Splunk Enterprise 7.3.  I'm fleshing out our upgrade task list for moving to 8.1.2.  What is the best way to manage the upgrade across all servers, and do I need to take any special steps to prevent loss of logs?  I have the task for the install itself, I need a game plan for how to do it across the 6 servers.  Will upgrading each server - one at a time, have it back up and running before I move to the next server - prevent log/data loss, or is it better practice to do all 6 servers at once (take them all down, upgrade them all, the bring them all back online).  Looking at the compatibility matrix the I should be able to do all the indexers first and have the heavy forwarders still be compatible.  Any advice on how to manage this is greatly appreciated. ... View more