Related Answers
Splunk Enterprise version 6.x is no longer supported as of October 23, 2019. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk.
Click here for the latest version.
Download topic as PDF
Compatibility between forwarders and indexers
Following are the specific version compatibility restrictions between forwarders and their receiving indexers. For best results, ensure that the version of the indexers is the same or higher than the version of the forwarders from which they receive data.
Forwarder-indexer compatibilty
- A forwarder that is version 6.0 or later can send data to an indexer that is version 5.0 or later.
- An indexer that is version 6.0 can receive data from a forwarder that is version 4.3 or later.
The following features are available only if both indexers and forwarders are at version 6.x or higher:
- Dynamic file headers.
- Forwarding of structured data.
- Timezone transmission by the forwarder. Additionally, forwarders do not maintain the timezone transmission feature across intermediate forwarding tiers when those tiers consist solely of light or universal forwarders.
Last modified on 12 May, 2017
|
PREVIOUS Forwarder deployment topologies |
NEXT Enable forwarding on a Splunk Enterprise instance |
This documentation applies to the following versions of Splunk® Enterprise: 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.9, 6.4.10, 6.4.11, 6.5.0, 6.5.1, 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.5.6, 6.5.7, 6.5.8, 6.5.9, 6.5.10
Feedback submitted, thanks!