Splunk® Enterprise

Forwarding Data

Download manual as PDF

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

Compatibility between forwarders and indexers

Here are the specific version compatibility restrictions between forwarders and their receiving indexers:

  • A forwarder that runs version 6.x can send data to indexers that run version 5.0.x and later.
  • An indexer that runs version 6.x can accept data from forwarders that run version 4.3.x and later.
  • Forwarders can be of any type: heavy, light, or universal. There are no compatibility differences between forwarder types.

The following 6.0 features are available only if both indexers and forwarders are at version 6.0 or higher:

  • Dynamic file headers
  • Forwarding of structured data
  • Timezone transmission by the forwarder. The timezone transmission feature of the 6.0+ protocol is not maintained across multiple forwarding links in a multilevel forwarding scenario where intermediate links are light or universal forwarders.

For app-specific compatibility restrictions, check the app's documentation on Splunkbase.

As a best practice, it is recommended that indexers be at the same or higher version level than the forwarders they're receiving data from.

PREVIOUS
Set up forwarding and receiving
  NEXT
Enable a receiver

This documentation applies to the following versions of Splunk® Enterprise: 6.1, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6, 6.1.7, 6.1.8, 6.1.9, 6.1.10, 6.1.11, 6.1.12, 6.1.13, 6.1.14, 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.2.9, 6.2.10, 6.2.11, 6.2.12, 6.2.13, 6.2.14, 6.2.15


Comments

Hi Anandhscareer,

I'm not sure what you mean by 'passing through the indexers' but a 6.1.0 forwarder can send data to a 6.2.0 indexer without a problem. Let me know if that answers your question.

Malmoore, Splunker
June 20, 2016

Hi we have installed splunk forwarder version 6.1 and we are using indexer 6.2.0 so will the data will be passing through the indexers?

Anandhscareer
June 20, 2016

Hi AaronMoorcroft,

Yes.

Malmoore
April 20, 2015

Will a 6. + forwarder work without issue with a 5.0.2 indexer ?

AaronMoorcroft
April 20, 2015

Hi Eiujmoore,

Yes, 6.2.2 forwarders should work without a problem on 6.0.5 indexers.

Malmoore
April 2, 2015

Will a 6.2.2 forwarder work with a 6.0.5 indexer? We will be upgrading soon, but need to install a couple of new forwarders and would like to avoid the need to upgrade those later.

Eiujmoore
March 24, 2015

Hi Ammula88,

6.2.1 forwarders should absolutely work with 6.2.0 indexers.

Malmoore
February 20, 2015

Is there a compatibility with 6.2.1 Universal forwarder and splunk 6.2.0 Indexers?

Ammula88
February 20, 2015

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters