Getting Data In

License implications between a light weight forwarder ans standard forwarder.

Path Finder

I would like to be able to filter events before it hits the indexer.

I tried putting the following in a app definition


REGEX = (\[SipServletRequestImpl\])
DEST_KEY = queue
FORMAT = nullQueue

and props.conf

TRANSFORMS-null= setnull

The app is deployed on a server that is set up as a light weight forwarder. This doesn't appear to work with light weight forwarders, and is confirmed with reading answers on here.

Question 1: What is the implication of moving from a light weight forwarder to a standard forwarder in terms of licensing? Do i need to have a separate license for a standard forwarder?

Question 2: Can I do the filtering on our main splunk server? That way I can continue using the light weight forwarder setup I already have.

The goal is to remove stuff from the log inputs so it doesn't count against or daily license limit.


Tags (2)

Re: License implications between a light weight forwarder ans standard forwarder.


Using a normal forwarder instead of a lightweight one doesn't necessarily have implications in terms of licensing. Only if you turn on the "indexAndForward" feature on the forwarder - which would lead to data beeing indexed on the forwarder is self as well as on the indexer - would be a reason to install a enterprise license. You can configure this option under Manager -> Forwarding & Receiving -> Forwarding defaults.

You can of course filter the events before beeing indexed on the indexer (in case you use the LW forwarder). You just have to configure the transforms there. The only downside is that all events go over the network.

View solution in original post