I need to upgrade a forwarder from a universal to a heavy weight one. Now I could just blow away my instance and start again however that would mean that all the data from the files would be resent. I don't want to change the inputs.conf with followTail as these are not under my control. So could just copy my old fish bucket to the new installation and it would work?
Given that a universal fowarder installs to /opt/splunkforwarder (or seems to in the system I am looking at for example) I believe a universal forwarder configuration can live alongside a heavy forwarder.
One problem is that /etc/init.d/splunk would get changed to point to the heavy fowarder in /opt/splunk so making certain that the universal forwarder is shut down before installing/configuring the heavy forwarder seems the way to go.
This is what I'm planning on doing with a syslog forwarder.