Splunk® Enterprise

Forwarding Data

Acrobat logo Download manual as PDF

Splunk Enterprise version 6.x is no longer supported as of October 23, 2019. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Acrobat logo Download topic as PDF

Compatibility between forwarders and indexers

Here are the specific version compatibility restrictions between forwarders and their receiving indexers:

  • A forwarder that runs version 6.x can send data to indexers that run version 5.0.x and later.
  • An indexer that runs version 6.x can accept data from forwarders that run version 4.3.x and later.
  • Forwarders can be of any type: heavy, light, or universal. There are no compatibility differences between forwarder types.

The following 6.x features are available only if both indexers and forwarders are at version 6.0 or higher:

  • Dynamic file headers
  • Forwarding of structured data
  • Timezone transmission by the forwarder. The timezone transmission feature of the 6.0+ protocol is not maintained across multiple forwarding links in a multilevel forwarding scenario where intermediate links are light or universal forwarders.

For app-specific compatibility restrictions, check the app documentation on Splunkbase.

As a best practice, we recommend that indexers be at the same or higher version of Splunk Enterprise than the forwarders they are receiving data from.

Last modified on 27 March, 2016
Forwarder deployment topologies
Universal forwarder deployment overview

This documentation applies to the following versions of Splunk® Enterprise: 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.3.14

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters