Compatibility between forwarders and indexers

Here are the specific version compatibility restrictions between forwarders and their receiving indexers:

• A forwarder that runs version 6.x can send data to indexers that run version 5.0.x and later.
• An indexer that runs version 6.x can accept data from forwarders that run version 4.3.x and later.
• Forwarders can be of any type: heavy, light, or universal. There are no compatibility differences between forwarder types.

The following 6.x features are available only if both indexers and forwarders are at version 6.0 or higher:

• Dynamic file headers
• Forwarding of structured data
• Timezone transmission by the forwarder. The timezone transmission feature of the 6.0+ protocol is not maintained across multiple forwarding links in a multilevel forwarding scenario where intermediate links are light or universal forwarders.

For app-specific compatibility restrictions, check the app documentation on Splunkbase.

As a best practice, we recommend that indexers be at the same or higher version of Splunk Enterprise than the forwarders they are receiving data from.