Splunk® Enterprise

Forwarding Data

Download manual as PDF

Download topic as PDF

Compatibility between forwarders and indexers

Following are the specific version compatibility restrictions between forwarders and their receiving indexers. Best practice is to ensure that the version of the indexers is the same or higher than the version of the forwarders that send data to the indexers.

Forwarder-indexer compatibility

  • A forwarder that is version 6.0 to 6.5 can send data to an indexer that is version 5.0 or later.
  • A forwarder that is version 6.6 or later can send data to an indexer that is version 6.0 or later.
  • A forwarder that is version 6.6 or later can also send data to a 5.0 indexer after you change the Secure Sockets Layer (SSL)/Transport Layer Security (TLS) version and cipher suite on the forwarder.
  • An indexer that is version 6.0 to 6.5 can receive data from a forwarder that is version 4.3 or later.
  • An indexer that is version 6.6 or later can receive data from a forwarder that is version 6.0 or later.
  • An indexer that is version 6.6 or later can receive data from a forwarder that is version 4.3 or later after you change the SSL/TLS version and cipher suite on the indexer.

To learn about how to change the cipher suites, see Known Issues in the Splunk Enterprise Release Notes.

The following features are available only if both indexers and forwarders are at version 6.x or higher:

  • Dynamic file headers.
  • Forwarding of structured data.
  • Timezone transmission by the forwarder. Additionally, forwarders do not maintain the timezone transmission feature across intermediate forwarding tiers when those tiers consist solely of light or universal forwarders.
PREVIOUS
Forwarder deployment topologies
  NEXT
Enable forwarding on a Splunk Enterprise instance

This documentation applies to the following versions of Splunk® Enterprise: 6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.6.5, 6.6.6, 6.6.7, 6.6.8, 6.6.9, 6.6.10, 6.6.11, 6.6.12


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters