
Compatibility between forwarders and indexers
Here are the specific version compatibility restrictions between forwarders and their receiving indexers:
- A forwarder that runs version 6.x can send data to indexers that run version 5.0.x and later.
- An indexer that runs version 6.x can accept data from forwarders that run version 4.3.x and later.
- Forwarders can be of any type: heavy, light, or universal. There are no compatibility differences between forwarder types.
The following 6.x features are available only if both indexers and forwarders are at version 6.0 or higher:
- Dynamic file headers
- Forwarding of structured data
- Timezone transmission by the forwarder. The timezone transmission feature of the 6.0+ protocol is not maintained across multiple forwarding links in a multilevel forwarding scenario where intermediate links are light or universal forwarders.
For app-specific compatibility restrictions, check the app documentation on Splunkbase.
As a best practice, we recommend that indexers be at the same or higher version of Splunk Enterprise than the forwarders they are receiving data from.
PREVIOUS Forwarder deployment topologies |
NEXT Universal forwarder deployment overview |
This documentation applies to the following versions of Splunk® Enterprise: 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.3.14
Feedback submitted, thanks!