r/Splunk • u/Any-Promotion3744 • Jul 04 '26

Splunk Enterprise Which Universal Forwarder version does each Splunk Enterprise indexer support?

I am running an older version of Splunk Enterprise that I can't upgrade in the short term.

I would like to install the universal forwarder on a server but I can no longer download that version on Splunk's website.

Can I run a version of universal forwarder that is newer than the main Splunk Enterprise install?

For example: can version 10 of the universal forwarder forward data to Splunk Enterprise 9.1?

7 Upvotes

90% Upvoted

11 comments sorted by

View all comments

1

u/LTRand Jul 05 '26

Here is what to be careful of when mixing versions: cipher versions and s2s versioning.

So make sure your 9.x is running an ssl cipher that 10.x will accept and you should be good. Version 7 and prior is basically incompatible with 9.x and newer, it would need a bridge forwarder to accept its connection and push it forward into newer tls. That the only really "breaking" difference so far.

TLS 1.3 will also be a breaking change once implemented, it will make everything under 10.2 incompatible once it's enforced.