Splunk® Enterprise

Forwarding Data

Splunk Enterprise version 7.3 is no longer supported as of October 22, 2021. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk® Enterprise. For documentation on the most recent version, go to the latest release.

Compatibility between forwarders and indexers

For Splunk Cloud Platform forwarder and indexer compatibility, see the Supported forwarder versions section of the Splunk Cloud Platform Service Description manual.

For Splunk Enterprise forwarder and indexer compatibility see Compatibility between forwarders and Splunk Enterprise indexers in the Splunk Products Version Compatibility Matrix manual.

Metrics forwarding compatibility

Metrics indexing from forwarders is supported only if both indexers and forwarders are at version 7.0.0 or later. There is no support for forwarding metrics data from a 6.6 or earlier forwarder to a 7.0 indexer.

Forwarding compatibility with other features

The following features are available only if both indexers and forwarders are at version 6.x or higher:

  • Dynamic file headers.
  • Forwarding of structured data.
  • Timezone transmission by the forwarder. Additionally, forwarders do not maintain the timezone transmission feature across intermediate forwarding tiers when those tiers consist solely of light or universal forwarders.
Last modified on 24 August, 2023
Forwarder deployment topologies   Enable forwarding on a Splunk Enterprise instance

This documentation applies to the following versions of Splunk® Enterprise: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.1.4, 7.3.0, 7.3.1, 7.3.2, 7.3.4, 7.3.8, 7.3.9, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10, 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.1.6, 8.1.7, 8.1.8, 8.1.9, 8.1.10, 8.1.11, 8.1.12, 8.1.13, 8.1.14, 7.3.3, 7.3.5, 7.3.6, 7.3.7


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters