Search head (forwarder license) disables distrbuted search from search head

Path Finder

Hi All,

I had distributed search configured with 4.1.3 "". I have upgraded the splunk to 4.2.1 with free trial license and it was still working. As soon as I changed the license group to use forwarder license. I have lost configurations (for multiple indexers) from distributed search. Can someone help ? i'm unable to configure distributed search from search head ????

Tags (2)



Prior to 4.2 it was recommended to use the forwarder license, however this is no longer the case.

Search head license (for distributed search)

A search head is a Splunk instance that distributes searches to other Splunk indexers. Search heads don't usually index any data locally, but you will still want to use a license to restrict access to them.

Note: In versions prior to 4.2, Splunk suggested using a forwarder license on your search heads, but now recommends that you add search heads to an Enterprise license pool even if they are not expected to index any data. If your existing search head has a pre-4.2 forwarder license installed, the forwarder license will not be read after you upgrade.

See also Types Of Licenses

Path Finder

Thanks... I have created indexer as master and search head as slave license resolved he issue

0 Karma
Get Updates on the Splunk Community!

Streamline Data Ingestion With Deployment Server Essentials

REGISTER NOW!Every day the list of sources Admins are responsible for gets bigger and bigger, often making the ...

Remediate Threats Faster and Simplify Investigations With Splunk Enterprise Security ...

REGISTER NOW!Join us for a Tech Talk around our latest release of Splunk Enterprise Security 7.2! We’ll walk ...

Introduction to Splunk AI

WATCH NOWHow are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. ...