Heavy Forwarder License Type?

[phularah]

I have a doubt. If we are using heavy forwarder to parse the data and forward it to indexers, does it need Enterprise license or just the forwarder license?

Can I use something like-> ./splunk edit licenser-groups Forwarder -is_active 1.
I don't want to use my HF as deployment server or LM or Monitoring Console. It's use is going to be to just  parse data received from UF and forward it to peers or indexers.

 Let's say now if I install add-ons like Splunk db connect. Then, would it require Enterprise license or just forwarder license would suffice? I am still just forwarding the data.

[gcusello · Accepted solution]

Hi @phularah ,

if you don't need to locally index you can use the Forwarder License that was created just for this purpose.

ciao.

Giuseppe

[gcusello]

Hi @phularah,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

[phularah]

Just to confirm, if I just want to parse and manipulate raw data with props, use add-ons to get data and forward it to indexers, no enterprise license is needed?

If I don't use enterprise license no error will come? 

[gcusello]

Hi @phularah ,

the Forwarder License was created just for these purposes: input, parse and forward data without local indexing.

You don't need a Splunk license on HF, you need it only on Indexers.

Ciao.

Giuseppe

[PickleRick]

There is one tricky thing about this.

A HF will work on its own perfectly well with the forwarder license.

But if you have more than one HF and you want to add them to be monitored in the MC (some people do want to see their HFs in the MC as a "half-indexer" in order to see the queues and such), you might get alerts about duplicate use of the same license.

In such case you need to add them to LM.

[gcusello]

Hi @phularah ,

as @isoutamo said, you need a license only if you locally index logs othwerwise you can use the Forwarder License.

Ciao.

Giuseppe

[isoutamo]

Exactly this way. No need for Enterprise license.

[isoutamo]

Hi

If you are using it just for collect and/or forwarding events you can just activate default Forwarder license. Of course you can add it also for license client to your LM if you want, but it's not deeded.

r. Ismo