Can UF still forward data if license expire?

[Naveen99]

Hello could you please help me to have better understanding of UF.

1. Can we still use Splunk UF even after the end date (license )  i.e Splunk agent still forward the data to QRadar?

[gcusello]

Hi @Naveen99,

Are you speaking of Universal or Heavy Forwarder?

Splunk Universal Forwarder hasn't a license so it should coultinue to work.

Splunk Heavy Forwarder, has a license that, after two months becames a Free license, that can be used only in stand-alone installations.

Only for my knowledge: are you using Splunk Universal Forwarder to send logs to Q-Radar? Why?

Ciao.

Giuseppe

[Naveen99]

Hi Gcusello,

Thanks for the Heads up. Coming to your question why we are using UF to forward data to QRadar.

We recently migrated from splunk to Qradar. so we  use wincollect to forward data into Qradar but we recently know that our license experied, to deploy all wincollects in servers it will take time so want to know whether Uf will still forward the data or not.

[gcusello]

Hi @Naveen99,

you have done the reverse path to what you usually do!

Anyway, I hope to answered to your question, if yes, please accept my aswer for ther other people of Community, otherwise, please tell me.

Ciao and happy splunking.

Giuseppe

P.S.: karma Points are appreciated 😉