Deployment Architecture

5.0.7 forwarder won't connect to 5.0.1 indexer, why not?

a212830
Champion

Hi,

We upgraded a splunkforwarder to 5.7, sending to a 5.01 indexer, and now they won't connect. I thought the minor revs were compilable?

Tags (1)
0 Karma

piebob
Splunk Employee
Splunk Employee

can you provide details about how they won't connect?

0 Karma

yannK
Splunk Employee
Splunk Employee

They are compatible.
Did you changed your configuration during the upgrade ?

0 Karma

yannK
Splunk Employee
Splunk Employee

Investigation steps :

If you have a support contract, you should open a case and attach a diag of the indexer and of the forwarder.

http://docs.splunk.com/Documentation/Splunk/5.0.1/Troubleshooting/Generateadiag

0 Karma

a212830
Champion

Thanks. Yeah, upgrading the indexers is a big deal. We are migrating towards 6.x with new hardware.

I'm getting a bunch of "can't connect" messages:

03-11-2014 13:45:56.078 -0400 INFO TailingProcessor - Could not send data to output queue (parsingQueue), retrying...
O BatchReader - Continuing...
03-11-2014 13:46:43.104 -0400 INFO BatchReader - Could not send data to output queue (parsingQueue), retrying...
03-11-2014 13:46:44.102 -0400 INFO BatchReader - Continuing...

0 Karma

yannK
Splunk Employee
Splunk Employee

remark : as a good practice, you should not keep indexers on 5.0.1 but upgrade to the last 5.* at least.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...