Can a 6.1.3 forwarder forward data to a 4.3.2 server?

[mestridge]

I have a 6.1.3 new forwarder set to forward to an installed 4.3.2 server. Will this work, or am I required to upgrade the server to 6.1.3?

[linu1988]

Upgrade to atleast Splunk 5 more so to splunk 6, splunk 6 forwarders wont forward to 4.x indexers.

[grijhwani]

The general rule is "no". Receivers are backwards compatible with senders, but not the other way around. So your indexer has to be the same release as the forwarders it receiving from, or higher.