Related Answers
Download topic as PDF
Compatibility between forwarders and indexers
Here are the specific version compatibility restrictions between forwarders and their receiving indexers:
- A forwarder that runs version 6.x can send data to indexers that run version 5.0.x and later.
- An indexer that runs version 6.x can accept data from forwarders that run version 4.3.x and later.
- Forwarders can be of any type: heavy, light, or universal. There are no compatibility differences between forwarder types.
The following 6.0 features are available only if both indexers and forwarders are at version 6.0 or higher:
- Dynamic file headers
- Forwarding of structured data
- Timezone transmission by the forwarder. The timezone transmission feature of the 6.0+ protocol is not maintained across multiple forwarding links in a multilevel forwarding scenario where intermediate links are light or universal forwarders.
For app-specific compatibility restrictions, check the app's documentation on Splunkbase.
As a best practice, it is recommended that indexers be at the same or higher version level than the forwarders they're receiving data from.
|
PREVIOUS Set up forwarding and receiving |
NEXT Enable a receiver |
This documentation applies to the following versions of Splunk® Enterprise: 6.1, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6, 6.1.7, 6.1.8, 6.1.9, 6.1.10, 6.1.11, 6.1.12, 6.1.13, 6.1.14, 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.2.9, 6.2.10, 6.2.11, 6.2.12, 6.2.13, 6.2.14, 6.2.15
Comments
Hi we have installed splunk forwarder version 6.1 and we are using indexer 6.2.0 so will the data will be passing through the indexers?
Hi AaronMoorcroft,
Yes.
Will a 6. + forwarder work without issue with a 5.0.2 indexer ?
Hi Eiujmoore,
Yes, 6.2.2 forwarders should work without a problem on 6.0.5 indexers.
Will a 6.2.2 forwarder work with a 6.0.5 indexer? We will be upgrading soon, but need to install a couple of new forwarders and would like to avoid the need to upgrade those later.
Hi Ammula88,
6.2.1 forwarders should absolutely work with 6.2.0 indexers.
Is there a compatibility with 6.2.1 Universal forwarder and splunk 6.2.0 Indexers?
Hi Anandhscareer,
I'm not sure what you mean by 'passing through the indexers' but a 6.1.0 forwarder can send data to a 6.2.0 indexer without a problem. Let me know if that answers your question.