Forwarder license

[twes]

Hello!

So one of the questions I see showing up in various quizzes/flashcards for the Administrator certification is "Which Splunk component requires a Forwarder license?", and two of the choices are HF and UF. The community seems pretty split on whether the right answer is UF or HF. The arguments for HF is that HF is a Splunk Enterprise instance with the Forwarding License required, and for UF that it has the forwarding license applied automatically. I guess the question comes down to what they mean by require a license, and I was hoping someone could give me some more clarity on which is the right answer and why.

Sources:

https://docs.splunk.com/Documentation/Splunk/8.1.0/Admin/Distdeploylicenses

Splunk Enterprise 8.2 Data Administration.pdf

[PickleRick]

I'd say that the proper answer is HF.

UF is just an UF and there's nothing special about it. HF is an instance of fully-blown Splunk Enterprise installation. You must have some form of license installed on it in order to work properly - trial license, free license, "normal" enterprise license or forwarder license. (or some other types like NFR,  devel or commercial trial but that's much less common case)