Getting Data In

Heavy Forwarder License Type?

phularah
Communicator

I have a doubt. If we are using heavy forwarder to parse the data and forward it to indexers, does it need Enterprise license or just the forwarder license?

Can I use something like-> ./splunk edit licenser-groups Forwarder -is_active 1.
I don't want to use my HF as deployment server or LM or Monitoring Console. It's use is going to be to just  parse data received from UF and forward it to peers or indexers.

 Let's say now if I install add-ons like Splunk db connect. Then, would it require Enterprise license or just forwarder license would suffice? I am still just forwarding the data.

 

 

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @phularah ,

if you don't need to locally index you can use the Forwarder License that was created just for this purpose.

ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @phularah ,

if you don't need to locally index you can use the Forwarder License that was created just for this purpose.

ciao.

Giuseppe

gcusello
SplunkTrust
SplunkTrust

Hi @phularah,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

0 Karma

phularah
Communicator

Just to confirm, if I just want to parse and manipulate raw data with props, use add-ons to get data and forward it to indexers, no enterprise license is needed?

If I don't use enterprise license no error will come? 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @phularah ,

the Forwarder License was created just for these purposes: input, parse and forward data without local indexing.

You don't need a Splunk license on HF, you need it only on Indexers.

Ciao.

Giuseppe

0 Karma

PickleRick
SplunkTrust
SplunkTrust

There is one tricky thing about this.

A HF will work on its own perfectly well with the forwarder license.

But if you have more than one HF and you want to add them to be monitored in the MC (some people do want to see their HFs in the MC as a "half-indexer" in order to see the queues and such), you might get alerts about duplicate use of the same license.

In such case you need to add them to LM.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @phularah ,

as @isoutamo said, you need a license only if you locally index logs othwerwise you can use the Forwarder License.

Ciao.

Giuseppe

isoutamo
SplunkTrust
SplunkTrust

Exactly this way. No need for Enterprise license.

isoutamo
SplunkTrust
SplunkTrust

Hi

If you are using it just for collect and/or forwarding events you can just activate default Forwarder license. Of course you can add it also for license client to your LM if you want, but it's not deeded.

r. Ismo

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...