is it possible to use Splunk as a SplunkWeb and Splunk forwarder?

[jangid]

I am using free version of Splunk and its working fine.

Is it possible to use same time as a forwarder also?

so same log file data set I can use in main instance and forwarded instance.

[MHibbin · Accepted solution]

Yes,

You need to set forwarding and receiving, and make sure that it is a Heavy forwarder for this to be indexed locally and somewhere else.

http://docs.splunk.com/Documentation/Splunk/5.0/Deploy/Distributedoverview

The light and universal forwarders both have the Splunkweb UI disabled.

If you mean you wish to have an instance of Splunk forward data to remote instance, but not index locally, and use the local machine as a search head, you should be able to do this as well but you require the enterprise license (please see this for comparison of licenses)

Cheers,