How to set up a license for a Heavy Forwarder that is also a Deployment Server?

[andrewdidone]

Hi.

I have an Indexer/SearchHead/Deploy server sitting on one zone, and a Heavy Forwarder/Deploy server sitting on another zone. Currently my license installed on the Indexer. Since the Heavy Forwarder is a Deployment Server, i am unable to use a free or forwarder license. How would i set up licensing here? Would i configure the forwarder as a slave and point it to the Indexer?

I've tried this and I receive the following error:

Bad Request — In handler 'localslave': editTracker failed, reason='WARN: path=/masterlm/usage: This license does not support being a remote master. from ip='  

Does this mean i need a specific license that allows a slave connection?

Thanks,
Andrew

[nickstone]

anyone know how this works with Splunk Cloud? or is it the same? Just point at Splunk Cloud as License Server?

[andrewdidone · Accepted solution]

Answering my own here. The answer is Yes. You set it up as a slave. My license was just an invalid one. After a proper license install, it seems to work fine now.

Hope this helps anyone else.

[napomokoetle]

Do you know if a pure Heavy Forwarder with NO deployment function and NO local indexing require a license? Or is it taken just like a Universal Forwarder?

[lakshman239]

No license is required for pure heavy forwarder - https://answers.splunk.com/answers/395082/do-we-need-a-license-for-heavy-forwarder.html

[andrewdidone]

If there is no deploy server functionality, and no indexing then i believe no license required. it'll just act as a relay. You just need to set up forwarding to the main indexer. Standard port is 9997.