How do I convert from a light forwarder to a full forwarder?

[Alan_Bradley]

I have a light forwarder (v4.0.7) I want to change this to a forwarder instead of a light forwarder. The reason being is that I want this forwarder to add some indexed fields to the mix before the data is sent over to the main index server. What are the steps involved to make this happen?

[gkanapathy]

You can disable the SplunkLightForwarder app, and enable the SplunkForwarder app (or not enable the SplunkForwarder app -- it doesn't actually do much besides turn off SplunkWeb). You will of course have to move all parsing-related configurations from your indexer to your forwarder now.

http://www.splunk.com/wiki/Where_do_I_configure_my_Splunk_settings%3F may help figure out which configurations.

My practice is to put all sourcetype-level props.conf and transforms.conf configurations into a single app, then replicate that app to search, indexer, and forwarder, using Deployment Server or similar to keep them in sync. These configurations that aren't appropriate will just be ignored, and you don't have to worry about if a forwarder is light or not, or if your indexer is also a searcher or not.

[oreoshake]

If for some reason you can't execute those commands, basically it just changes the value for etc/apps/Splunk(Light)Forwarder/local/app.conf

[install]

state = enabled|disabled

Some of our SAs prefer to just modify the configs directly.

So in your case...

create etc/apps/SplunkForwarder/local/app.conf with

[install]

state = enabled

And change the value in etc/apps/SplunkLightForwarder/local/app.conf

[install]

state = disabled

[BunnyHop · Accepted solution]

Since SplunkWeb is disabled, you will have to do it on the CLI:

cd %SPLUNK%
splunk disable app SplunkLightForwarder
splunk enable app SplunkForwarder
splunk restart