Splunk enterprise and splunk light forwarder

[perplexed]

Hi,

I have Splunk enterprise installed on a ubuntu 18.04 server. When I enable the Splunk Light Weight Forwarder and restart splunk enterprise the web UI no longer loads for Splunk Enterprise.

[isoutamo]

As light forwarder is already deprecated since v.6 you should use Universal Forwarder if possible.

If I read below manual right it said that the same instance cannot be both receiver and light forwarder at same time. So you must use UF or configure that Enterprise instance to indexing also local files if needed.

https://docs.splunk.com/Documentation/Splunk/8.0.5/Forwarding/Deployaforwarder

r. Ismo