Training + Certification

Forwarder license



So one of the questions I see showing up in various quizzes/flashcards for the Administrator certification is "Which Splunk component requires a Forwarder license?", and two of the choices are HF and UF. The community seems pretty split on whether the right answer is UF or HF. The arguments for HF is that HF is a Splunk Enterprise instance with the Forwarding License required, and for UF that it has the forwarding license applied automatically. I guess the question comes down to what they mean by require a license, and I was hoping someone could give me some more clarity on which is the right answer and why.


Splunk Enterprise 8.2 Data Administration.pdf

0 Karma

Ultra Champion

I'd say that the proper answer is HF.

UF is just an UF and there's nothing special about it. HF is an instance of fully-blown Splunk Enterprise installation. You must have some form of license installed on it in order to work properly - trial license, free license, "normal" enterprise license or forwarder license. (or some other types like NFR,  devel or commercial trial but that's much less common case)

Get Updates on the Splunk Community!

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...

Cloud Platform | Discontinuing support for TLS version 1.0 and 1.1

Overview Transport Layer Security (TLS) is a security communications protocol that lets two computers, ...