Is there a specific license needed to support indexing on a heavy forwarder?

[dharris_splunk]

Please advise as to whether a specific license is needed to support indexing on a heavy forwarder; Like an indexing license?

[PickleRick]

HF is just an indexer with local indexing disabled. So if you want to index locally you're effectively turning your server into indexer with additional forwarding enabled.

So while for "pure HF" the forwarder license will do, for "indexing HF" you need to properly license the instance as if you'd do with any other indexer.

[gcusello]

Hi @dharris_splunk ,

there's only one license to index logs, the normal license, as described at https://docs.splunk.com/Documentation/Splunk/9.3.1/Admin/TypesofSplunklicenses .

Only for HFs, there's a Forwarder license but it doesn't permits to locally index logs.

Ciao.

Giuseppe

[sainag_splunk]

 HF do NOT need an enterprise license if you are just ingesting/parsing. 

On a HF, if you are locally indexing "you need an enterprise license" 

If this reply helps, Please UpVote