As light forwarder is already deprecated since v.6 you should use Universal Forwarder if possible. If I read below manual right it said that the same instance cannot be both receiver and light forwarder at same time. So you must use UF or configure that Enterprise instance to indexing also local files if needed. https://docs.splunk.com/Documentation/Splunk/8.0.5/Forwarding/Deployaforwarder r. Ismo ... View more