Getting Data In

Lightweight Forwarder to Universal Forwarder Migration?

the_wolverine
Champion

I just got off the phone with Support and was told that I needed to use Universal Forwarder (mode) in order to forward data from 4.2 forwarders to 4.1 legacy indexers. It sounds like the Universal Forwarder is the "new" even lighter than LightWeight forwarder?

If a full version of Splunk was installed, what are the steps to reconfigure it as a Universal Forwarder?

matt
Splunk Employee
Splunk Employee

enabling the app does not make an instance a universal forwarder. You must install the new universal binaries

0 Karma

Steve_G_
Splunk Employee
Splunk Employee

The Universal Forwarder is its own, separate executable. Unlike the light/heavy forwarders of yore, you do not enable it from a full Splunk instance.

To download the Universal Forwarder, go here:

http://www.splunk.com/download/universalforwarder

ftk
Motivator

The universal forwarder is indeed an even more lightweight forwarder than the previous lightweight forwarder configuration. The documentation has articles on migrating both Windows forwarders to the UF as well as Unix forwarders. I recommend reading the Intro to Universal Forwarder chapter as well.

the_wolverine
Champion

Currently I don't see a lot of documentation on how to manually configure this. I was able to figure out by running ./splunk list apps which apps are enabled. Then I deduced that I could enable the universal forwarder by running ./splunk enable apps UniversalForwarder.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...