Splunk UF version 9.4 version in Windows 2008 R2 machines?

[tech_g706]

Hi,
We have some Windows 2008 R2 machines where UF 7.2 is running, and in Splunk Cloud CMC, we are getting the forwarder status as critical.

My question is, can we install 9.4 or above 9 on the  Windows 2008 R2 machines?

If not, what is the minimum supported UF version for Windows 2008 R2, and possible workaround to mitigate the critical status notification on Splunk Cloud CMC?

Thank you!

[livehybrid]

Hi @tech_g706 

The last version that was listed as supporting Windows 2008 was 7.2.10 (See https://docs.splunk.com/Documentation/Splunk/7.2.10/Installation/Systemrequirements) - This lists it as Deprecated and it was removed from the next version.

UF 7.2.10 actually went out of Splunk support in April 2021 (With P3 support ending in 2023).

The following shows a matrix of supported forwarders->Indexers which might also be useful: https://docs.splunk.com/Documentation/VersionCompatibility/current/Matrix/Compatibilitybetweenforwar...

Unfortunately it looks like you might already be on the latest version known to work with Windows 2008. It not being listed doesnt necessarily mean it wont work with 2008 - but it wont be supported and there may be issues we arent aware of.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[PickleRick]

I wouldn't expect any modern UF to be not only supported but also to work.

That windows release is so out of support that I'd be more concerned with the OS itself than the UF version.

[gcusello]

Hi @tech_g706 ,

there isn't any 8.x version certified compatible with Windows 2008/R2 and supported by Splunk.

Probably the 9.4.x version runs on Windows 2008/R2 but it isn't certified and supported by Splunk.

The only that  can formally answer to your question is Splunk Support.

Ciao.

Giuseppe