Splunk Enterprise

Can Splunk Light be converted to a heavy forwarder?

smithpj
Explorer

Before we purchased an Enterprise license, we had an installation of Splunk Light running collecting a smallish amount of data. We've turned up an Enterprise search head, with a couple of indexers and we're just now circling back to this initial installation we had of Light. Is it possible to take it that Light installation that is still humming along, and turn it into a heavy forwarder for our new Enterprise solution or would it be best to just scrap that install, and rebuild it anew as strictly a forwarder?

jterry
Splunk Employee
Splunk Employee

As rbittner says above:

You have to convert your SL instance to an Enterprise instance. Installing SE on top of SL will work. The SE trial license will trump the SL license. Once you have your instance running as SE point it to the master license server.

0 Karma

somesoni2
Revered Legend

You should be able to just upgrade that instance to SPlunk Enterprise instance (and setup that as HF). It should be easy as per the Splunk Light page http://www.splunk.com/en_us/products/splunk-light.html

0 Karma

smithpj
Explorer

Sadly I get dead-ended at this page:

http://docs.splunk.com/Documentation/SplunkLight/6.3.0/Installation/AboutmigratingSplunkLight

It says that yes it's a valid migration path, but nothing more on /how/ to fulfill that migration.. I would it might be as simple as just applying a license, but Light doesn't appear to allow me to point it to a remote master license server..

0 Karma

somesoni2
Revered Legend

You should just install Splunk Enterprise on top of your Splunk Light installation. After that you will get all the options, including remote license master configuration.

0 Karma

rbittner_splunk
Splunk Employee
Splunk Employee

You have to convert your SL instance to an Enterprise instance. Installing SE on top of SL will work. The SE trial license will trump the SL license. Once you have your instance running as SE point it to the master license server.

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...