Lightweight Forwarder to Universal Forwarder Migration?

[the_wolverine]

I just got off the phone with Support and was told that I needed to use Universal Forwarder (mode) in order to forward data from 4.2 forwarders to 4.1 legacy indexers. It sounds like the Universal Forwarder is the "new" even lighter than LightWeight forwarder?

If a full version of Splunk was installed, what are the steps to reconfigure it as a Universal Forwarder?

[matt]

enabling the app does not make an instance a universal forwarder. You must install the new universal binaries

[Steve_G_]

The Universal Forwarder is its own, separate executable. Unlike the light/heavy forwarders of yore, you do not enable it from a full Splunk instance.

To download the Universal Forwarder, go here:

http://www.splunk.com/download/universalforwarder

[ftk]

The universal forwarder is indeed an even more lightweight forwarder than the previous lightweight forwarder configuration. The documentation has articles on migrating both Windows forwarders to the UF as well as Unix forwarders. I recommend reading the Intro to Universal Forwarder chapter as well.

[the_wolverine]

Currently I don't see a lot of documentation on how to manually configure this. I was able to figure out by running ./splunk list apps which apps are enabled. Then I deduced that I could enable the universal forwarder by running ./splunk enable apps UniversalForwarder.