Compatibility between forwarders and indexers
The Universal Forwarder Manual has the most up-to-date information on compatibility between forwarders and indexers. See the table in Compatibility between forwarders and Splunk Enterprise indexers in that manual.
Metrics forwarding compatibility
Metrics indexing from forwarders is supported only if both indexers and forwarders are at version 7.0.0 or later. There is no support for forwarding metrics data from a 6.6 or earlier forwarder to a 7.0 indexer.
Forwarding compatibility with other features
The following features are available only if both indexers and forwarders are at version 6.x or higher:
- Dynamic file headers.
- Forwarding of structured data.
- Timezone transmission by the forwarder. Additionally, forwarders do not maintain the timezone transmission feature across intermediate forwarding tiers when those tiers consist solely of light or universal forwarders.
Forwarder deployment topologies
Enable forwarding on a Splunk Enterprise instance
This documentation applies to the following versions of Splunk Cloud™: 7.0.13, 8.2.2104, 7.2.9, 7.2.10, 8.0.2006, 8.0.2007, 8.1.2008, 8.1.2009, 8.1.2011, 8.1.2012 (latest FedRAMP release), 8.1.2101, 8.1.2103