Splunk enterprise and splunk light forwarder

perplexed — Thu, 20 Aug 2020 05:14:08 GMT

Hi,

I have Splunk enterprise installed on a ubuntu 18.04 server. When I enable the Splunk Light Weight Forwarder and restart splunk enterprise the web UI no longer loads for Splunk Enterprise.

Re: Splunk enterprise and splunk light forwarder

isoutamo — Thu, 20 Aug 2020 06:17:18 GMT

As light forwarder is already deprecated since v.6 you should use Universal Forwarder if possible.

If I read below manual right it said that the same instance cannot be both receiver and light forwarder at same time. So you must use UF or configure that Enterprise instance to indexing also local files if needed.

https://docs.splunk.com/Documentation/Splunk/8.0.5/Forwarding/Deployaforwarder

r. Ismo

topic Splunk enterprise and splunk light forwarder in Installation

Splunk enterprise and splunk light forwarder

Re: Splunk enterprise and splunk light forwarder