topic Re: Running a Universal Forwarder on the same server as the Enterprise server. in Getting Data In

Running a Universal Forwarder on the same server as the Enterprise server.

acsplunkuser — Thu, 10 Apr 2014 20:52:09 GMT

I have a Solaris 10 standalone server. Can I run a Universal Forwarder (6.0.2) on the same server that Enterprise (also 6.0.2) is running on with the forwarder sending to Enterprise on this same server? This is for testing/learning/evaluation and not expected to be the final configuration. I looked through the 'Answers' area but came up blank. Thanks

Re: Running a Universal Forwarder on the same server as the Enterprise server.

martin_mueller — Thu, 10 Apr 2014 21:00:12 GMT

I see no reason why not, there's a few pitfalls though: Make sure you're disciplined about paths and ports.
By default, full Splunk installs end up in /opt/splunk and UF installs end up in /opt/splunkforwarder, which can lead to tab completion mistakes if you're not careful.
Similarly, by default both will try to use port 8089 for their management port - that needs to be changed on at least one obviously. Here Splunk's quite helpful by asking you to change it on first launch if the default is in use already.

Re: Running a Universal Forwarder on the same server as the Enterprise server.

acsplunkuser — Fri, 11 Apr 2014 13:27:44 GMT

Thanks for the help. And after spending time in the online documentation I came across this note in the section explaining the Universal Forwarder:
Note: The universal forwarder is a separate executable from full Splunk Enterprise. Instances of full Splunk Enterprise and the universal forwarder can co-exist on the same system.

Re: Running a Universal Forwarder on the same server as the Enterprise server.

markakirkland — Fri, 28 Sep 2018 15:31:54 GMT

I realize that this is a very late answer... but, I would like to add that, in addition to the above, if you are running Linux<=6.9 (just not sure about 7.x)... AND you "enable boot-start"... Splunk UF and Splunk Enterprise have the same name. In other words , I had to modify the name of the forwarder script in init.d and manually add the script to chkconfig.