Getting Data In

Lightweigth forwarder upgrade

cafissimo
Communicator

Hello, I am going to upgrade splunk light forwarder to splunk universal forwarder. In the splunk documentation I'have found some steps to follow. In particular I should (as written in "http://www.splunk.com/base/Documentation/latest/Deploy/Migrateanixforwarder") as mentioned at step 3: "3. In the universal forwarder's installation directory, $SPLUNK_HOME, create a file named old_splunk.seed; in other words: $SPLUNK_HOME/old_splunk.seed. This file must contain a single line, consisting of the path of the old forwarder's $SPLUNK_HOME directory. For example: /opt/splunk. " Does it mean that the universal forwarder has to be installed in a different directory than /opt/splunk if the light forwarder is installed in /opt/splunk? Thanks and kind regards, Luca Caldiero, Consoft Sistemi S.p.A.

0 Karma
1 Solution

Steve_G_
Splunk Employee
Splunk Employee

You cannot actually upgrade from the light forwarder to the universal forwarder, but you can migrate your light forwarder settings to the universal forwarder. This is an important distinction.

Unlike the light forwarder, the universal forwarder is an entirely separate download and executable from full Splunk. Do not install it over an existing installation of full Splunk (including light forwarder or heavy forwarder).

View solution in original post

0 Karma

Steve_G_
Splunk Employee
Splunk Employee

You cannot actually upgrade from the light forwarder to the universal forwarder, but you can migrate your light forwarder settings to the universal forwarder. This is an important distinction.

Unlike the light forwarder, the universal forwarder is an entirely separate download and executable from full Splunk. Do not install it over an existing installation of full Splunk (including light forwarder or heavy forwarder).

0 Karma

Branden
Builder

Yes, you should install the Universal Forwarder in a different directory than the SplunkLightForwarder.

The instructions confused me at first too. I always installed the SplunkLightForwarder in /splunk, but then I noticed that the UniversalForwarder tarball extracts to /splunkforwarder, so that's where I installed it. (That's how it worked on AIX anyway.) Worked great.

Hope that helps!

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...