Getting Data In

Does UF supports props.conf

BoldKnowsNothin
Path Finder

Hello comrades,

After my poor research, I found that only heavy forwarder supports props.conf, but it was like 5 or 6 years old posts. I wonder that UF could now support props.conf? Also how do I upgrade to HF?

Many thanks,

 

0 Karma
1 Solution

inventsekar
Ultra Champion

yep, the props.conf on the UF is very very limited.

SEDCMD on props.conf is only for HF or indexer etc.. 

View solution in original post

inventsekar
Ultra Champion

Yes, HF requires a license. 

 

For a heavy forwarder (HF), you should set up one of the following options:

1) Make the HF a slave of a license master. This will give the HF all of the enterprise capabilities - and the HF will consume no license, as long as it does not index data.

2) Install the forwarder license. This will give the HF many enterprise capabilities, but not all. The HF will be able to parse and forward data. However, it will not be permitted to index and it will not be able to act as a deployment server (as an example). This is the option I would usually choose. (Note that the Universal Forwarder has the forwarder license pre-installed.)

answer from - https://community.splunk.com/t5/Getting-Data-In/Do-we-need-a-license-for-Heavy-forwarder/m-p/210451

 

0 Karma

BoldKnowsNothin
Path Finder

Sir,

If I can frankly say all I'm trying to do is here.

Configure the Splunk Add-on for Windows - Splunk Documentation 

unfortunately there isn't any information about forwarders here.

0 Karma

inventsekar
Ultra Champion

that page gives very good list of Splunk commands... which step you are stuck exactly.. 

0 Karma

BoldKnowsNothin
Path Finder

All commands with SEDCMD

0 Karma

inventsekar
Ultra Champion

SEDCMD is a big topic and your one line reply is not helping me/us. 

maybe you should provide moooore details and ask precise questions. 

 

upvotes/karma points are appreciated by all. thanks. 

BoldKnowsNothin
Path Finder

Sorry for trouble,

As I named myself...

1. Document mentioned that I have to create props.conf in /opt/splunk/deployment.apps/Splunk-TA-windows/local/   ---> created

2. I just copied all lines with SEDCMD and cleared # 

and just hoping to config should work.

All this changes made yesterday,  

Tags (1)
0 Karma

inventsekar
Ultra Champion

>>> 1. Document mentioned that I have to create props.conf in /opt/splunk/deployment.apps/Splunk-TA-windows/local/   ---> created ..... 

did you create this on the HF, right?


>>> 2. I just copied all lines with SEDCMD and cleared #  and just hoping to config should work.

after updating the props.conf in Hf, did you restart the splunk service on the HF

BoldKnowsNothin
Path Finder

did you create this on the HF, right?

hehe no, that's why I started asking about HF. So UF cannot take this SEDCMD configs right?

0 Karma

inventsekar
Ultra Champion

yep, the props.conf on the UF is very very limited.

SEDCMD on props.conf is only for HF or indexer etc.. 

BoldKnowsNothin
Path Finder

Sorry  one last question. 

Do you suggest us to shift to HF or use indexer?

0 Karma

inventsekar
Ultra Champion

Hi @BoldKnowsNothin ... the UF, still supports, only very limited props.conf tasks. 

https://docs.splunk.com/Documentation/Splunk/9.1.1/admin/Propsconf

on this document, just do a control-F and search for universal.. you will get around 8 matches... only these settings are supported. 

>>> Also how do I upgrade to HF?

generally you dont want to upgrade a UF to a HF.. you need to install a new/fresh HF separately on a system. 

you downlad splunk enterprise package and install it.. and then enable it as a heavy forwarder. let us know if you have doubts.. thanks. 

BoldKnowsNothin
Path Finder

Hello comrade inventsekar,

Thank you for your help, do I need other kind of licensing to use HV?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...