https://community.splunk.com/t5/Getting-Data-In/How-to-downgrade-a-Heavy-Forwarder-to-a-Universal-Forwarder/m-p/573151#M101380 <P>The Splunk Documentation has steps to upgrade a Universal Forwarder to a Heavy Forwarder. But not any steps on downgrading.&nbsp;</P><P>Is it the same steps except swap where it says UF for HF and HF for UF?</P><P>I'm guessing it would go like:&nbsp;</P><P>1. Install UF and stop the HF</P><P>2. Copy&nbsp;<SPAN>$SPLUNK_HOME/var/lib/splunk/* from HF to the UF</SPAN></P><P><SPAN>3. Copy over the inputs.conf, outputs.conf, etc from the HF to the UF?</SPAN></P><P>&nbsp;</P><P>&nbsp;</P><P><SPAN>Does it work like this?</SPAN></P><P>&nbsp;</P> Mon, 01 Nov 2021 12:34:08 GMT Stefanie 2021-11-01T12:34:08Z https://community.splunk.com/t5/Getting-Data-In/How-to-downgrade-a-Heavy-Forwarder-to-a-Universal-Forwarder/m-p/573151#M101380 <P>The Splunk Documentation has steps to upgrade a Universal Forwarder to a Heavy Forwarder. But not any steps on downgrading.&nbsp;</P><P>Is it the same steps except swap where it says UF for HF and HF for UF?</P><P>I'm guessing it would go like:&nbsp;</P><P>1. Install UF and stop the HF</P><P>2. Copy&nbsp;<SPAN>$SPLUNK_HOME/var/lib/splunk/* from HF to the UF</SPAN></P><P><SPAN>3. Copy over the inputs.conf, outputs.conf, etc from the HF to the UF?</SPAN></P><P>&nbsp;</P><P>&nbsp;</P><P><SPAN>Does it work like this?</SPAN></P><P>&nbsp;</P> Mon, 01 Nov 2021 12:34:08 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-downgrade-a-Heavy-Forwarder-to-a-Universal-Forwarder/m-p/573151#M101380 Stefanie 2021-11-01T12:34:08Z https://community.splunk.com/t5/Getting-Data-In/How-to-downgrade-a-Heavy-Forwarder-to-a-Universal-Forwarder/m-p/573177#M101386 <P>HWF generally have props.conf and transforms.conf to parse the data. If you're downgrading HWF to UF, you should first move those configurations to next full Splunk instances (generally indexers). It should be done before you start the downgrade.</P> Mon, 01 Nov 2021 14:59:33 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-downgrade-a-Heavy-Forwarder-to-a-Universal-Forwarder/m-p/573177#M101386 somesoni2 2021-11-01T14:59:33Z https://community.splunk.com/t5/Getting-Data-In/How-to-downgrade-a-Heavy-Forwarder-to-a-Universal-Forwarder/m-p/573187#M101391 <P>Thank you, that makes sense. Appreciate it.</P> Mon, 01 Nov 2021 15:39:49 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-downgrade-a-Heavy-Forwarder-to-a-Universal-Forwarder/m-p/573187#M101391 Stefanie 2021-11-01T15:39:49Z