Getting Data In

How do I convert from a light forwarder to a full forwarder?

Path Finder

I have a light forwarder (v4.0.7) I want to change this to a forwarder instead of a light forwarder. The reason being is that I want this forwarder to add some indexed fields to the mix before the data is sent over to the main index server. What are the steps involved to make this happen?

0 Karma
1 Solution

Contributor

Since SplunkWeb is disabled, you will have to do it on the CLI:

cd %SPLUNK%
splunk disable app SplunkLightForwarder
splunk enable app SplunkForwarder
splunk restart

View solution in original post

Splunk Employee
Splunk Employee

You can disable the SplunkLightForwarder app, and enable the SplunkForwarder app (or not enable the SplunkForwarder app -- it doesn't actually do much besides turn off SplunkWeb). You will of course have to move all parsing-related configurations from your indexer to your forwarder now.

http://www.splunk.com/wiki/Where_do_I_configure_my_Splunk_settings%3F may help figure out which configurations.

My practice is to put all sourcetype-level props.conf and transforms.conf configurations into a single app, then replicate that app to search, indexer, and forwarder, using Deployment Server or similar to keep them in sync. These configurations that aren't appropriate will just be ignored, and you don't have to worry about if a forwarder is light or not, or if your indexer is also a searcher or not.

Communicator

If for some reason you can't execute those commands, basically it just changes the value for etc/apps/Splunk(Light)Forwarder/local/app.conf

[install]

state = enabled|disabled

Some of our SAs prefer to just modify the configs directly.

So in your case...

create etc/apps/SplunkForwarder/local/app.conf with

[install]

state = enabled

And change the value in etc/apps/SplunkLightForwarder/local/app.conf

[install]

state = disabled

Contributor

Since SplunkWeb is disabled, you will have to do it on the CLI:

cd %SPLUNK%
splunk disable app SplunkLightForwarder
splunk enable app SplunkForwarder
splunk restart

View solution in original post

Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!