SplunkForwarder and SplunkLightForwarder Apps - Can they be removed?

[zindain24]

Our Splunk installations have installed apps named SplunkForwarder and SplunkLightForwarder. The apps are disabled, and no users have write or read permissions. What are their purpose? Do you have any advice whether they can/should they be removed? Thanks!

SplunkForwarder SplunkForwarder
Yes
No
App | Permissions Disabled | Enable
SplunkLightForwarder SplunkLightForwarder
Yes
No
App | Permissions Disabled | Enable

[Ayn · Accepted solution]

If you don't have any plans on making forwarders out of these Splunk instances, you can safely delete these apps, as all they do is provide ready-made settings for this functionality.

[yannK]

Remark, they will be reinstalled when you upgrade.

[zindain24]

Great, Thank you!

[martin_mueller]

SplunkForwarder = heavy forwarder