Hi,
Does a universal forwarder need any type of licensing stanza? I see this in the default server.conf entry:
./system/README/server.conf.spec:active_group = Enterprise | Trial | Forwarder | Free
I can see how this can be misleading since it's a 'Free Trial' licenses. Good observation
See the following link on forwarder licenses:
https://docs.splunk.com/Splexicon:Forwardinglicense
Since, the UF is not responsible for indexing any data, it does not need access to your paid for license but it does have its own type of license.
Building on that, it will show a stanza in the server.conf but it doesn't require an enterprise license.
