SplunkLightForwarder has been deprecated in Splunk 6?

[Dark_Ichigo]

initially I had thought that the SplunkLightForwarder had less impact on performance when installed on a platform, however I have now read that the Universal Forwarder is in fact a more lighter and better solution (Correct me if Im wrong).

I had previously installed a number of LightForwarders on some of my platforms, but after reading that SplunkLightForwarder has now been deprecated from Splunk 6, should I now move to the Splunk Universal Forwarder Solution?

[MuS · Accepted solution]

Hi Dark_Ichigo,

Yes, you should use the Universal Forwarder like stated in the docs.

One thing to remember: you cannot actually upgrade from the light forwarder to the universal forwarder. You only can 'migrate' your light forwarder settings to the universal forwarder. This is an important distinction.

Unlike the light forwarder, the universal forwarder is an entirely separate download and executable from full Splunk. Do not install it over an existing installation of full Splunk (including light forwarder or heavy forwarder).

After the initial setup of the Universal Forwarder the upgrade is easy, there are two docs on upgrade the unix universal forwarder and upgrade the windows universal forwarder

hope this helps ...

cheers, MuS