Compatibility between forwarders and indexers
Here are the specific version compatibility restrictions between forwarders and their receiving indexers:
- A forwarder that runs version 6.x can send data to indexers that run version 5.0.x and later.
- An indexer that runs version 6.x can accept data from forwarders that run version 4.3.x and later.
- Forwarders can be of any type: heavy, light, or universal. There are no compatibility differences between forwarder types.
The following 6.0 features are available only if both indexers and forwarders are at version 6.0 or higher:
- Dynamic file headers
- Forwarding of structured data
- Timezone transmission by the forwarder. The timezone transmission feature of the 6.0+ protocol is not maintained across multiple forwarding links in a multilevel forwarding scenario where intermediate links are light or universal forwarders.
For app-specific compatibility restrictions, check the app's documentation on Splunkbase.
As a best practice, it is recommended that indexers be at the same or higher version level than the forwarders they're receiving data from.
Set up forwarding and receiving
Enable a receiver
This documentation applies to the following versions of Splunk® Enterprise: 6.1, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6, 6.1.7, 6.1.8, 6.1.9, 6.1.10, 6.1.11, 6.1.12, 6.1.13, 6.1.14, 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.2.9, 6.2.10, 6.2.11, 6.2.12, 6.2.13, 6.2.14, 6.2.15