Security

is it possible to use Splunk as a SplunkWeb and Splunk forwarder?

jangid
Builder

I am using free version of Splunk and its working fine.

Is it possible to use same time as a forwarder also?

so same log file data set I can use in main instance and forwarded instance.

Tags (1)
0 Karma
1 Solution

MHibbin
Influencer

Yes,

You need to set forwarding and receiving, and make sure that it is a Heavy forwarder for this to be indexed locally and somewhere else.

http://docs.splunk.com/Documentation/Splunk/5.0/Deploy/Distributedoverview

The light and universal forwarders both have the Splunkweb UI disabled.

If you mean you wish to have an instance of Splunk forward data to remote instance, but not index locally, and use the local machine as a search head, you should be able to do this as well but you require the enterprise license (please see this for comparison of licenses)

Cheers,

View solution in original post

MHibbin
Influencer

Yes,

You need to set forwarding and receiving, and make sure that it is a Heavy forwarder for this to be indexed locally and somewhere else.

http://docs.splunk.com/Documentation/Splunk/5.0/Deploy/Distributedoverview

The light and universal forwarders both have the Splunkweb UI disabled.

If you mean you wish to have an instance of Splunk forward data to remote instance, but not index locally, and use the local machine as a search head, you should be able to do this as well but you require the enterprise license (please see this for comparison of licenses)

Cheers,

Get Updates on the Splunk Community!

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

You’ve probably heard the latest about AppDynamics joining the Splunk Observability portfolio, deepening our ...

Monitoring Amazon Elastic Kubernetes Service (EKS)

As we’ve seen, integrating Kubernetes environments with Splunk Observability Cloud is a quick and easy way to ...

Cloud Platform & Enterprise: Classic Dashboard Export Feature Deprecation

As of Splunk Cloud Platform 9.3.2408 and Splunk Enterprise 9.4, classic dashboard export features are now ...