Enable the Splunk light forwarder via the deployment server
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Enable the Splunk light forwarder via the deployment server
Splunk 3.4 introduces the Splunk light forwarder application. Enabling this application on your Splunk deployment client configures it to be a Splunk light forwarder. This application is installed with Splunk 3.4 and later by default, but is not enabled by default.
Once you've installed Splunk on your deployment clients, you can use the Splunk deployment server to enable the Splunk light forwarder application.
To do this, you must first have set up a deployment server and clients. Then, deploy the $SPLUNK_HOME/etc/modules/distributedDeployment/classes/EnableLightForwarder server class using the standard deployment instructions. This restarts Splunk on the deployment client, and enables the light forwarder.
You can configure the deployment client to monitor the files and directories you're interested in either before or after you enable the light forwarder. Refer to these recommendations before proceeding.
Note: You cannot use "round-robin" forwarding in conjunction with the light forwarder because the data is not parsed before being sent--events may be split into parts before reaching the receiver, resulting in partial events.
This documentation applies to the following versions of Splunk: 3.4 , 3.4.1 , 3.4.2 , 3.4.3 , 3.4.5 , 3.4.6 , 3.4.8 , 3.4.9 , 3.4.10 , 3.4.11 , 3.4.12 , 3.4.13 , 3.4.14 View the Article History for its revisions.