Search head (forwarder license) disables distrbuted search from search head

Path Finder

Hi All,

I had distributed search configured with 4.1.3 "". I have upgraded the splunk to 4.2.1 with free trial license and it was still working. As soon as I changed the license group to use forwarder license. I have lost configurations (for multiple indexers) from distributed search. Can someone help ? i'm unable to configure distributed search from search head ????

Tags (2)



Prior to 4.2 it was recommended to use the forwarder license, however this is no longer the case.

Search head license (for distributed search)

A search head is a Splunk instance that distributes searches to other Splunk indexers. Search heads don't usually index any data locally, but you will still want to use a license to restrict access to them.

Note: In versions prior to 4.2, Splunk suggested using a forwarder license on your search heads, but now recommends that you add search heads to an Enterprise license pool even if they are not expected to index any data. If your existing search head has a pre-4.2 forwarder license installed, the forwarder license will not be read after you upgrade.

See also Types Of Licenses

Path Finder

Thanks... I have created indexer as master and search head as slave license resolved he issue

0 Karma
Get Updates on the Splunk Community!

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...

Platform Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestIntroducing Splunk Edge Processor, simplified data ...