Installation

Search head (forwarder license) disables distrbuted search from search head

amitsehgal
Path Finder

Hi All,

I had distributed search configured with 4.1.3 "forwarder@splunk.com". I have upgraded the splunk to 4.2.1 with free trial license and it was still working. As soon as I changed the license group to use forwarder license. I have lost configurations (for multiple indexers) from distributed search. Can someone help ? i'm unable to configure distributed search from search head ????

Tags (2)

hazekamp
Builder

amitsehgal,

Prior to 4.2 it was recommended to use the forwarder license, however this is no longer the case.

Search head license (for distributed search)

A search head is a Splunk instance that distributes searches to other Splunk indexers. Search heads don't usually index any data locally, but you will still want to use a license to restrict access to them.

Note: In versions prior to 4.2, Splunk suggested using a forwarder license on your search heads, but now recommends that you add search heads to an Enterprise license pool even if they are not expected to index any data. If your existing search head has a pre-4.2 forwarder license installed, the forwarder license will not be read after you upgrade.

See also Types Of Licenses

amitsehgal
Path Finder

Thanks... I have created indexer as master and search head as slave license resolved he issue

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...