Compatibility between forwarders and indexers
Here are the specific version compatibility restrictions between forwarders and their receiving indexers:
- A forwarder that runs version 6.x can send data to indexers that run version 5.0.x and later.
- An indexer that runs version 6.x can accept data from forwarders that run version 4.3.x and later.
- Forwarders can be of any type: heavy, light, or universal. There are no compatibility differences between forwarder types.
The following 6.0 features are available only if both indexers and forwarders are at version 6.0 or higher:
- Dynamic file headers
- Timezone transmission by the forwarder.
Note: As a special limitation, the timezone transmission feature of the 6.0+ protocol is not maintained across multiple forwarding links in a multi-level forwarding scenario where intermediate links are light or universal forwarders.
For app-specific compatibility restrictions, check the app's documentation on Splunk Apps.
As a best practice, it is recommended that indexers be at the same or higher version level than the forwarders they're receiving data from.
Set up forwarding and receiving
Enable a receiver
This documentation applies to the following versions of Splunk® Enterprise: 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, 6.0.7, 6.0.8, 6.0.9, 6.0.10, 6.0.11, 6.0.12, 6.0.13, 6.0.14, 6.0.15