Troubleshooting compatibility issues between components or apps in Splunk Enterprise
With a number of different moving parts to a Splunk deployment, it can sometimes be unclear what versions of your universal forwarders will work with different versions of your indexers. There is also added complexity between applications and your search head version, with large changes between v8 and v9.
You might find that you commonly upgrade your indexers, search heads and so on without upgrading the Universal Forwarders until you need to. Although indexers are backwards compatible with older forwarder versions, they can have limitations on the features available between the two, and this can cause discrepancies such as expecting metrics indexes to be available when they are not.
Solution
Checking compatibility between indexers and forwarders
By utilizing the compatibility matrix accessible via Splunk Docs you can make sure you are able to maintain functionality between your indexers and forwarders. Even if your forwarders are on an older version, it will also show limitations on versions if there are any:
Checking compatibility between Splunk Enterprise and Splunk Enterprise Security, Splunk ITSI or Splunk IT Essentials Work
If you are using a premium app, there are also supported Splunk and app versions which can also be checked at Splunk products version compatibility matrix.
Checking app compatibility
Click the Version History section on the Splunkbase page for the app you want to check.
Before upgrading, check if the version of the app you are running will be compatible with the version you are upgrading to. You might need to upgrade the app after you upgrade. Apps that are not compatible with the Splunk version you are on will still be able to be installed or opened after the upgrade, but you might see some unexpected behavior such as dashboards not loading, or the app failing to open at all.
Checking upgrade readiness
You can use the Upgrade Readiness app to automatically comb through your deployment and highlight any other areas where you may have issues with your upgrade.
Next steps
If you still need assistance with this procedure, UK-based Somerford Associates can help. Somerford Associates is an award winning Elite Partner with Splunk and the largest Partner Practice of Consultants in EMEA. We protect data, demonstrate that it is being managed effectively and derive greater value, by providing real-time insights to support effective decision making. With our specialist knowledge, skills, experience and strong reputation for enabling digital transformation at scale and at pace, we provide full delivery, including design, implementation, deployment and support. Find us on Splunk Partnerverse.
The user- and community-generated information, content, data, text, graphics, images, videos, documents and other materials made available on Splunk Lantern is Community Content as provided in the terms and conditions of the Splunk Website Terms of Use, and it should not be implied that Splunk warrants, recommends, endorses or approves of any of the Community Content, nor is Splunk responsible for the availability or accuracy of such. Splunk specifically disclaims any liability and any actions resulting from your use of any information provided on Splunk Lantern.