Splunk® Enterprise

Forwarding Data

Download manual as PDF

Splunk Enterprise version 7.0 is no longer supported as of October 23, 2019. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
Download topic as PDF

Compatibility between forwarders and indexers

The Universal Forwarder Manual has the most up-to-date information on compatibility between forwarders and indexers. See the table in Compatibility between forwarders and Splunk Enterprise indexers in that manual.

Metrics forwarding compatibility

Metrics indexing from forwarders is supported only if both indexers and forwarders are at version 7.0.0 or later. There is no support for forwarding metrics data from a 6.6 or earlier forwarder to a 7.0 indexer.

Forwarding compatibility with other features

The following features are available only if both indexers and forwarders are at version 6.x or higher:

  • Dynamic file headers.
  • Forwarding of structured data.
  • Timezone transmission by the forwarder. Additionally, forwarders do not maintain the timezone transmission feature across intermediate forwarding tiers when those tiers consist solely of light or universal forwarders.
Forwarder deployment topologies
Enable forwarding on a Splunk Enterprise instance

This documentation applies to the following versions of Splunk® Enterprise: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 8.0.0, 8.0.1, 8.0.2


Hi all,

To answer the open questions:

1. Metrics requires both a 7.0 indexer and forwarder. Other versions are not officially supported.

2.We realize this list has becomeconfusing and are in the process of drafting a table that should clear up things considerably. Thank you for your patience.

Malmoore, Splunker
March 12, 2018

I agree, a confusing document, and a direct contradiction between
"A forwarder that is version 6.0 to 6.5 can send data to an indexer that is version 5.0 or later, BUT LESS THAN 6.0."
"An indexer that is version 6.0 to 6.5 can receive data from a forwarder that is version 4.3 or later, including 7.0."

March 12, 2018

Shouldn't the first quote under "Forwarder-to-indexer-compability" say
"A forwarder that is version 6.0 to 6.5 can send data to an indexer that is version 5.0 or later, but less than 7.0." instead of "...,but less than 6.0"?

Pyro wood
February 13, 2018

Can a 7.0 UF forward to a 6.6 indexer assuming no metrics are used?

October 23, 2017

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters