Getting Data In

SplunkLightForwarder has been deprecated in Splunk 6?

Dark_Ichigo
Builder

initially I had thought that the SplunkLightForwarder had less impact on performance when installed on a platform, however I have now read that the Universal Forwarder is in fact a more lighter and better solution (Correct me if Im wrong).

I had previously installed a number of LightForwarders on some of my platforms, but after reading that SplunkLightForwarder has now been deprecated from Splunk 6, should I now move to the Splunk Universal Forwarder Solution?

1 Solution

MuS
SplunkTrust
SplunkTrust

Hi Dark_Ichigo,

Yes, you should use the Universal Forwarder like stated in the docs.

One thing to remember: you cannot actually upgrade from the light forwarder to the universal forwarder. You only can 'migrate' your light forwarder settings to the universal forwarder. This is an important distinction.

Unlike the light forwarder, the universal forwarder is an entirely separate download and executable from full Splunk. Do not install it over an existing installation of full Splunk (including light forwarder or heavy forwarder).

After the initial setup of the Universal Forwarder the upgrade is easy, there are two docs on upgrade the unix universal forwarder and upgrade the windows universal forwarder

hope this helps ...

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi Dark_Ichigo,

Yes, you should use the Universal Forwarder like stated in the docs.

One thing to remember: you cannot actually upgrade from the light forwarder to the universal forwarder. You only can 'migrate' your light forwarder settings to the universal forwarder. This is an important distinction.

Unlike the light forwarder, the universal forwarder is an entirely separate download and executable from full Splunk. Do not install it over an existing installation of full Splunk (including light forwarder or heavy forwarder).

After the initial setup of the Universal Forwarder the upgrade is easy, there are two docs on upgrade the unix universal forwarder and upgrade the windows universal forwarder

hope this helps ...

cheers, MuS

Get Updates on the Splunk Community!

Testing out the OpenTelemetry Collector With raw Data

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

New Cloud Intrusion Detection System Add-on for Splunk

In July 2022 Splunk released the Cloud IDS add-on which expanded Splunk capabilities in security and data ...

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...