topic Re: Search head (forwarder license) disables distrbuted search from search head in Installation

Search head (forwarder license) disables distrbuted search from search head

amitsehgal — Wed, 11 May 2011 17:18:48 GMT

Hi All,

I had distributed search configured with 4.1.3 "forwarder@splunk.com". I have upgraded the splunk to 4.2.1 with free trial license and it was still working. As soon as I changed the license group to use forwarder license. I have lost configurations (for multiple indexers) from distributed search. Can someone help ? i'm unable to configure distributed search from search head ????

Re: Search head (forwarder license) disables distrbuted search from search head

hazekamp — Wed, 11 May 2011 19:00:54 GMT

amitsehgal,

Prior to 4.2 it was recommended to use the forwarder license, however this is no longer the case.

Search head license (for distributed search)

A search head is a Splunk instance that distributes searches to other Splunk indexers. Search heads don't usually index any data locally, but you will still want to use a license to restrict access to them.

Note: In versions prior to 4.2, Splunk suggested using a forwarder license on your search heads, but now recommends that you add search heads to an Enterprise license pool even if they are not expected to index any data. If your existing search head has a pre-4.2 forwarder license installed, the forwarder license will not be read after you upgrade.

Re: Search head (forwarder license) disables distrbuted search from search head

amitsehgal — Wed, 11 May 2011 19:57:39 GMT

Thanks... I have created indexer as master and search head as slave license resolved he issue