topic Re: Full stack splunk in Splunk Enterprise

What is the difference between full stack splunk and splunk enterprise?

Shakeer_Spl — Tue, 31 Jan 2023 22:47:42 GMT

Hi Folks,

Please note that I am new to splunk,

I have a question what is the difference between full stack splunk and splunk enterprise

Would be appreciate your kind support you

Re: Full stack splunk

gcusello — Tue, 31 Jan 2023 12:56:23 GMT

Hi @Shakeer_Spl,

Splunk sells it's main solution in two ways:

Splunk Cloud,
Splunk Enterprise.

Splunk Enterprise is the on-premise version of Splunk Platform, differentiated by Splunk Cloud.

Splunk Enterprise can have many roles, but it's used always the same software version with the only exception of Splunk Universal Forwarder.

When you speak of full stack Splunk, probably you want to differentiate Splunk Heavy Forwarder from Splunk Universal Forwarder that are two different products and distributions:

Splunk Universal Forwarder is an agent: a light versione of Splunk (different than Splunk Enterprise), without GUI, used only to ingest logs.
Splunk Heavy Forwarder is a full stack Splunk Enterprise version of the product, where some features (e.g. indexing) aren't used because the scope of this role is take logs and forward them to Indexers.

Ciao.

Giuseppe

Re: Full stack splunk

Shakeer_Spl — Tue, 31 Jan 2023 20:59:41 GMT

Hi gcusello,

Thanks for your time, i would like to ask you that splunk enterprise version is Splunk full stack which is required to configuring splunk heavy forwarders

that I understood from your answer is it correct please let me know

Thanks for your kind support

Re: Full stack splunk

gcusello — Wed, 01 Feb 2023 07:43:08 GMT

Hi @Shakeer_Spl,

Splunk on premise has two main products (there are many others but for this scope two products):

Splunk Enterprise:
Splunk Universal Forwarder.

The second is a light agent that can be used only to input data and is usually installed on the target servers.

The second is a full stack version of the product that is usually installed on one or more dedicated servers, it can be used for all roles except agent: Indexer, Search Head, Heavy Forwarder, Master Node, License master, Deployer.

What is your requirement?

Ciao.

Giuseppe

Re: Full stack splunk

PickleRick — Wed, 01 Feb 2023 10:32:58 GMT

It's hard to say what you mean by "full stack".

Splunk as a company has many different products/services. Typically when talking about "Splunk" as a product it's implied that we're talking about environment of Splunk Enterprise or Splunk Free (which is the same Splunk Enterprise binary but with a limited Splunk Free license applied) instance(s) and Splunk Universal Forwarders

Splunk Enterprise can be configured, depending on the needed role, as indexer, search-head, heavy forwarder, deployment server, shc deployer, cluster manager. But these are all instances of Splunk Enterprise servers.

Re: What is the difference between full stack splunk and splunk enterprise?

hrottenberg_spl — Wed, 11 Jun 2025 20:40:39 GMT

The best terms to use here are either "server", or "deployment". I would avoid the term "stack", as that does not translate well to the typical web developer definition of that term. The below should help to distinguish further:

Splunk Server	Generic term to indicate any host (computer) that provides a Splunk service
Splunk Deployment	Collective term referring to one or more Splunk servers that satisfy the various roles needed to provide a Splunk service.

See also: cluster, tier, search tier, search peer, index tier, role

Ref:

[1]: https://help.splunk.com/en/splunk-cloud-platform/administer/admin-manual/9.3.2411/get-started-managing-splunk-cloud-platform/splunk-cloud-platform-deployment-types

[2]: https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/9.4/welcome-to-splunk-enterprise-administration/splunk-platform-administration-the-big-picture

Re: Full stack splunk

gcusello — Thu, 12 Jun 2025 06:40:41 GMT

Hi @Shakeer_Spl ,

as I said, there isn't a version of Splunk Full Stack, there are two versions of Splunk on premise:

Splunk Enterprise
Splunk Universal Forwarder.

The full Stack is only Splunk Enterprise.

For both the products there are many version (the last released is 9.4.3) and you can find it at https://www.splunk.com/en_us/download/splunk-enterprise.html .

let us know if we can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉