Is it safe to use a 6.5.2 universal forwarder with a 6.5.1 indexer?

[broomejohnp]

I would like to deploy the latest 64-bit Windows forwarder (6.5.2) but we are still at 6.5.1 for our indexers.

[aaraneta_splunk]

@broomejohnp - Did one of the answers below help provide a solution your question? If yes, please click “Accept” below the best answer to resolve this post and upvote anything that was helpful. If no, please leave a comment with more feedback. Thanks.

[nickhills]

As @somesoni2 mentioned its probably best practice to keep everything at the same version, but the important line from the link reads:

A universal forwarder that is version 6.0 or later can send data to a Splunk Enterprise indexer that is version 5.0 or later

In our environment I have several hundred universal forwarders running 6.5.2 forwarding to a 6.5.0 index cluster with no issues.

[somesoni2]

It's recommended (for best practices) that indexers should be at same or higher version as the forwarder, for best results, but since both are same major version, I don't see any issues in that. For more info on the restrictions, see this.

http://docs.splunk.com/Documentation/Forwarder/6.5.2/Forwarder/Compatibilitybetweenforwardersandinde...

[ddrillic]

Fascinating -