topic Re: How can you tell the difference between a light forwarder and a full forwarder in Splunk's internal logs? in Getting Data In https://community.splunk.com/t5/Getting-Data-In/How-can-you-tell-the-difference-between-a-light-forwarder-and-a/m-p/61105#M12133 <P>I checked something out on my "newly" created LWF on Sol.10 x86 with Splunk 4.1.7:</P> <P>/usr/xpg4/bin/grep -E 'Splunkd starting|controlqueueoutput' $SPLUNK_HOME/var/log/splunk/splunkd.log</P> <PRE><CODE>03-17-2011 20:31:14.482 INFO loader - Splunkd starting (build 95063). 03-17-2011 20:48:06.492 INFO loader - Splunkd starting (build 95063). 03-17-2011 20:53:55.356 INFO loader - Splunkd starting (build 95063). 03-17-2011 20:58:52.969 INFO loader - Splunkd starting (build 95063). 03-17-2011 20:59:03.029 INFO loader - Instantiated plugin: controlqueueoutputprocessor </CODE></PRE> <P>Only, LWF shows <STRONG>controlqueueoutputprocessor</STRONG>, regular forwarders dont - means, my last boot was as LWF!</P> <P>Note: You'd have checked <EM>splunk status</EM> (splunkwebd isn't running on a LWF), but you asked for the splunkd.log</P> Fri, 18 Mar 2011 05:21:55 GMT LCM 2011-03-18T05:21:55Z How can you tell the difference between a light forwarder and a full forwarder in Splunk's internal logs? https://community.splunk.com/t5/Getting-Data-In/How-can-you-tell-the-difference-between-a-light-forwarder-and-a/m-p/61104#M12132 <P>I have a forwarder that appears to be a LWF (SplunkLightForwarder app is enabled) however I am seeing messages about unable to send to output queue parsingQueue. I thought the LWFs didn't do parsing.</P> <P>How do I tell from Splunk's logs (splunkd.log, others?) that this is definitely a light forwarder and not attempting to parse events, perhaps through an errant setting somewhere?</P> Thu, 17 Mar 2011 04:14:25 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-you-tell-the-difference-between-a-light-forwarder-and-a/m-p/61104#M12132 Jason 2011-03-17T04:14:25Z Re: How can you tell the difference between a light forwarder and a full forwarder in Splunk's internal logs? https://community.splunk.com/t5/Getting-Data-In/How-can-you-tell-the-difference-between-a-light-forwarder-and-a/m-p/61105#M12133 <P>I checked something out on my "newly" created LWF on Sol.10 x86 with Splunk 4.1.7:</P> <P>/usr/xpg4/bin/grep -E 'Splunkd starting|controlqueueoutput' $SPLUNK_HOME/var/log/splunk/splunkd.log</P> <PRE><CODE>03-17-2011 20:31:14.482 INFO loader - Splunkd starting (build 95063). 03-17-2011 20:48:06.492 INFO loader - Splunkd starting (build 95063). 03-17-2011 20:53:55.356 INFO loader - Splunkd starting (build 95063). 03-17-2011 20:58:52.969 INFO loader - Splunkd starting (build 95063). 03-17-2011 20:59:03.029 INFO loader - Instantiated plugin: controlqueueoutputprocessor </CODE></PRE> <P>Only, LWF shows <STRONG>controlqueueoutputprocessor</STRONG>, regular forwarders dont - means, my last boot was as LWF!</P> <P>Note: You'd have checked <EM>splunk status</EM> (splunkwebd isn't running on a LWF), but you asked for the splunkd.log</P> Fri, 18 Mar 2011 05:21:55 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-you-tell-the-difference-between-a-light-forwarder-and-a/m-p/61105#M12133 LCM 2011-03-18T05:21:55Z Re: How can you tell the difference between a light forwarder and a full forwarder in Splunk's internal logs? https://community.splunk.com/t5/Getting-Data-In/How-can-you-tell-the-difference-between-a-light-forwarder-and-a/m-p/61106#M12134 <P>Great - yes, I control splunkweb independently of LWF sometimes, so I wanted to know from splunkd.log.</P> Mon, 21 Mar 2011 22:33:33 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-you-tell-the-difference-between-a-light-forwarder-and-a/m-p/61106#M12134 Jason 2011-03-21T22:33:33Z