topic Re: Is there a specific license needed to support indexing on a heavy forwarder? in Getting Data In

Is there a specific license needed to support indexing on a heavy forwarder?

dharris_splunk — Wed, 06 Nov 2024 18:40:34 GMT

Please advise as to whether a specific license is needed to support indexing on a heavy forwarder; Like an indexing license?

Re: Is there a specific license needed to support indexing on a heavy forwarder?

sainag_splunk — Thu, 07 Nov 2024 05:08:24 GMT

HF do NOT need an enterprise license if you are just ingesting/parsing.

On a HF, if you are locally indexing "you need an enterprise license"

If this reply helps, Please UpVote

Re: Is there a specific license needed to support indexing on a heavy forwarder?

gcusello — Thu, 07 Nov 2024 07:09:45 GMT

Hi @dharris_splunk ,

there's only one license to index logs, the normal license, as described at https://docs.splunk.com/Documentation/Splunk/9.3.1/Admin/TypesofSplunklicenses .

Only for HFs, there's a Forwarder license but it doesn't permits to locally index logs.

Ciao.

Giuseppe

Re: Is there a specific license needed to support indexing on a heavy forwarder?

PickleRick — Thu, 07 Nov 2024 08:08:23 GMT

HF is just an indexer with local indexing disabled. So if you want to index locally you're effectively turning your server into indexer with additional forwarding enabled.

So while for "pure HF" the forwarder license will do, for "indexing HF" you need to properly license the instance as if you'd do with any other indexer.