topic Re: Heavy Forwarder License Type? in Getting Data In

Heavy Forwarder License Type?

phularah — Fri, 18 Aug 2023 13:09:50 GMT

I have a doubt. If we are using heavy forwarder to parse the data and forward it to indexers, does it need Enterprise license or just the forwarder license?

Can I use something like-> ./splunk edit licenser-groups Forwarder -is_active 1.
I don't want to use my HF as deployment server or LM or Monitoring Console. It's use is going to be to just parse data received from UF and forward it to peers or indexers.

Let's say now if I install add-ons like Splunk db connect. Then, would it require Enterprise license or just forwarder license would suffice? I am still just forwarding the data.

Re: Heavy Forwarder License Type?

isoutamo — Fri, 18 Aug 2023 13:20:29 GMT

If you are using it just for collect and/or forwarding events you can just activate default Forwarder license. Of course you can add it also for license client to your LM if you want, but it's not deeded.

r. Ismo

Re: Heavy Forwarder License Type?

gcusello — Fri, 18 Aug 2023 14:02:33 GMT

Hi @phularah ,

if you don't need to locally index you can use the Forwarder License that was created just for this purpose.

ciao.

Giuseppe

Re: Heavy Forwarder License Type?

phularah — Fri, 18 Aug 2023 14:48:21 GMT

Just to confirm, if I just want to parse and manipulate raw data with props, use add-ons to get data and forward it to indexers, no enterprise license is needed?

If I don't use enterprise license no error will come?

Re: Heavy Forwarder License Type?

isoutamo — Fri, 18 Aug 2023 14:52:08 GMT

Exactly this way. No need for Enterprise license.

Re: Heavy Forwarder License Type?

gcusello — Fri, 18 Aug 2023 14:53:16 GMT

Hi @phularah ,

as @isoutamo said, you need a license only if you locally index logs othwerwise you can use the Forwarder License.

Ciao.

Giuseppe

Re: Heavy Forwarder License Type?

gcusello — Fri, 18 Aug 2023 14:57:01 GMT

Hi @phularah,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

Re: Heavy Forwarder License Type?

gcusello — Tue, 05 Dec 2023 07:28:12 GMT

Hi @phularah ,

the Forwarder License was created just for these purposes: input, parse and forward data without local indexing.

You don't need a Splunk license on HF, you need it only on Indexers.

Ciao.

Giuseppe

Re: Heavy Forwarder License Type?

PickleRick — Tue, 05 Dec 2023 13:56:53 GMT

There is one tricky thing about this.

A HF will work on its own perfectly well with the forwarder license.

But if you have more than one HF and you want to add them to be monitored in the MC (some people do want to see their HFs in the MC as a "half-indexer" in order to see the queues and such), you might get alerts about duplicate use of the same license.

In such case you need to add them to LM.