How to configure Heavy Forwarder with License Slave in Splunk Cloud

[markuxProof]

Greetings,

Is it possible to set up a heavy forwarder as a license slave in a Spluk Cloud architecture?

[prakash007]

If you don't index the data locally on a HF....you can use a forwarder(1MB) license

https://answers.splunk.com/answers/395082/do-we-need-a-license-for-heavy-forwarder.html

[markuxProof]

tks, mcnamara.

But in my case, I need an HF because I'm using the SA-LDAPSearch add-on that I can not install on the Universal Forwarder.

I need to access the license master in the Splunk Cloud, but I do not know if this is possible.

[prakash007]

If I am not wrong, you can use a forwarder license on the HF and install the add-ons, as it does have the advancing parsing capabilities...

http://docs.splunk.com/Documentation/SA-LdapSearch/2.1.4/User/Platformandhardwarerequirements

[markuxProof]

But does HF continue to run ldap queries?

If HF does not lose the ability to run LDAP queries, I can resolve the problem.

[Esky73]

Splunk can supply a 0 byte splunk license for your HF and you should still be able to use all your apps as designed as long as no indexing is configured locally.

[markuxProof]

There was a question: Do LDAP queries performed by the SA-LDAPSearch add-on continue to run on a heavy forwarder using the Forwarder license?