Like to quick check on how splunk forwarder license works...
Not sure why mzorzi sends you to the dark,,his initial answer were 100% wrong,,,and you can stuck with gkanapathy's comments for forwarders as well.
see http://www.splunk.com/wiki/Where_do_I_configure_my_Splunk_settings%3F for the different fucntions...
forwarders are input, parsing pipelines,,,,NO indexing no licensestuff!!!!
Forwarder license is Enterprise. It should not be your regular license, but the $SPLUNK_HOME/etc/splunk-forwarder.license file that is shipped with every Splunk package. You can just copy this file to splunk.license.
Yes it is. 1MB is just a minimum license. Forwarders don't actually need any licensing, since they don't index.
Doesn't matter. Violating a license (because some amount does get indexed) results in search being disabled. Forwarders don't perform search.
The forwarder license should not be expiring any time soon. It also doesn't matter in practice, again because once it expires, only search is disabled. Forwarders don't perform search.