I just got off the phone with Support and was told that I needed to use Universal Forwarder (mode) in order to forward data from 4.2 forwarders to 4.1 legacy indexers. It sounds like the Universal Forwarder is the "new" even lighter than LightWeight forwarder?
If a full version of Splunk was installed, what are the steps to reconfigure it as a Universal Forwarder?
Currently I don't see a lot of documentation on how to manually configure this. I was able to figure out by running ./splunk list apps which apps are enabled. Then I deduced that I could enable the universal forwarder by running ./splunk enable apps UniversalForwarder.
The Universal Forwarder is its own, separate executable. Unlike the light/heavy forwarders of yore, you do not enable it from a full Splunk instance.
To download the Universal Forwarder, go here: