Getting Data In

SplunkLightForwarder has been deprecated in Splunk 6?

Dark_Ichigo
Builder

initially I had thought that the SplunkLightForwarder had less impact on performance when installed on a platform, however I have now read that the Universal Forwarder is in fact a more lighter and better solution (Correct me if Im wrong).

I had previously installed a number of LightForwarders on some of my platforms, but after reading that SplunkLightForwarder has now been deprecated from Splunk 6, should I now move to the Splunk Universal Forwarder Solution?

1 Solution

MuS
SplunkTrust
SplunkTrust

Hi Dark_Ichigo,

Yes, you should use the Universal Forwarder like stated in the docs.

One thing to remember: you cannot actually upgrade from the light forwarder to the universal forwarder. You only can 'migrate' your light forwarder settings to the universal forwarder. This is an important distinction.

Unlike the light forwarder, the universal forwarder is an entirely separate download and executable from full Splunk. Do not install it over an existing installation of full Splunk (including light forwarder or heavy forwarder).

After the initial setup of the Universal Forwarder the upgrade is easy, there are two docs on upgrade the unix universal forwarder and upgrade the windows universal forwarder

hope this helps ...

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi Dark_Ichigo,

Yes, you should use the Universal Forwarder like stated in the docs.

One thing to remember: you cannot actually upgrade from the light forwarder to the universal forwarder. You only can 'migrate' your light forwarder settings to the universal forwarder. This is an important distinction.

Unlike the light forwarder, the universal forwarder is an entirely separate download and executable from full Splunk. Do not install it over an existing installation of full Splunk (including light forwarder or heavy forwarder).

After the initial setup of the Universal Forwarder the upgrade is easy, there are two docs on upgrade the unix universal forwarder and upgrade the windows universal forwarder

hope this helps ...

cheers, MuS

View solution in original post

.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!