Getting Data In

Lightweight Forwarder to Universal Forwarder Migration?

the_wolverine
Champion

I just got off the phone with Support and was told that I needed to use Universal Forwarder (mode) in order to forward data from 4.2 forwarders to 4.1 legacy indexers. It sounds like the Universal Forwarder is the "new" even lighter than LightWeight forwarder?

If a full version of Splunk was installed, what are the steps to reconfigure it as a Universal Forwarder?

matt
Splunk Employee
Splunk Employee

enabling the app does not make an instance a universal forwarder. You must install the new universal binaries

0 Karma

Steve_G_
Splunk Employee
Splunk Employee

The Universal Forwarder is its own, separate executable. Unlike the light/heavy forwarders of yore, you do not enable it from a full Splunk instance.

To download the Universal Forwarder, go here:

http://www.splunk.com/download/universalforwarder

ftk
Motivator

The universal forwarder is indeed an even more lightweight forwarder than the previous lightweight forwarder configuration. The documentation has articles on migrating both Windows forwarders to the UF as well as Unix forwarders. I recommend reading the Intro to Universal Forwarder chapter as well.

the_wolverine
Champion

Currently I don't see a lot of documentation on how to manually configure this. I was able to figure out by running ./splunk list apps which apps are enabled. Then I deduced that I could enable the universal forwarder by running ./splunk enable apps UniversalForwarder.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

REGISTER NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If ...

Observability | Use Synthetic Monitoring for Website Metadata Verification

If you are on Splunk Observability Cloud, you may already have Synthetic Monitoringin your observability ...

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...