Licsencing Question Splunk Intermediate Heavy Forwarder for like 200 GB per day

[haraldcgi]

We would like to use the Intermediate Heavy Forwarder Licsence is free or not for like 200 gb Traffic over it).
We are thinking about implementing Splunk IHF for a customer - can you please answer this

[haraldcgi]

I just got maybe an somewhat unusual question: Is it possible to use the Intermediate Heavy Forwarder without the Splunk Enterprise or other parts installed ?

[gjanders]

You can use a splunk universal forwarder as an aggregation point...

A UF can receive data and forward the data. However the best practice is forwarder to indexer where possible

[haraldcgi]

Thank you for the additional info.

[haraldcgi]

Thank you for your quick answer.

[gjanders · Accepted solution]

The forwarder license has zero cost, you can forward as much as you like.

Licensing is charged for indexed data for event data and differently for metrics, for more details refer to How Splunk Enterprise licensing works