Will there be any issues directly upgrading from Splunk 6.0.2 to 6.1.2?

[sushma7]

Hi Team,

I am planning to upgrade the SPLUNK from 6.0.2 to higher and version i.e. 6.1.2.

Can I do a direct upgrade from 6.0.2 to 6.1.2? Will there be any issues?

If I upgrade the SPLUNK machine, do I need to upgarde all the universal forwarders to the same

version? Only then it works?

Kindly answer me to these questions.

Thanks & Regards,
Sushma.

[martin_mueller · Accepted solution]

Upgrading within version 6 is pretty straightforward, just make sure you take the usual precautions such as backing up stuff beforehand.
There's no need to update all the forwarders at the same time, forwarder to indexer compatibility is extremely flexible.

[martin_mueller]

Unless there's a reason to upgrade the forwarders (e.g. SSL versions with vulnerabilities) then there's no real benefit to put in the effort of upgrading potentially thousands of forwarders. There may be features added between major versions, e.g. here: http://docs.splunk.com/Documentation/Splunk/6.1.2/Forwarding/Compatibilitybetweenforwardersandindexe... but within a major version I see no point.

[sushma7]

Ok so you meant to say that forwarders may/may not be upgraded as soon as I upgrade the indexer, but the best practise is to upgrade even the forwarders as well to match the indexer version, am I right?