Hello! So one of the questions I see showing up in various quizzes/flashcards for the Administrator certification is "Which Splunk component requires a Forwarder license?", and two of the choices are HF and UF. The community seems pretty split on whether the right answer is UF or HF. The arguments for HF is that HF is a Splunk Enterprise instance with the Forwarding License required, and for UF that it has the forwarding license applied automatically. I guess the question comes down to what they mean by require a license, and I was hoping someone could give me some more clarity on which is the right answer and why. Sources: https://docs.splunk.com/Documentation/Splunk/8.1.0/Admin/Distdeploylicenses Splunk Enterprise 8.2 Data Administration.pdf
... View more