Splunk® Universal Forwarder

Forwarder Manual

This documentation does not apply to the most recent version of Splunk® Universal Forwarder. For documentation on the most recent version, go to the latest release.

Migrate a Windows light forwarder

If you want to replace an existing light forwarder with a universal forwarder, you need to first migrate its checkpoint data to the new forwarder. Checkpoint data is internal data that the forwarder compiles to keep track of what data it has already forwarded to an indexer. By migrating the checkpoint data, you prevent the new universal forwarder from forwarding any data already sent by the old light forwarder. This ensures that the same data does not get indexed twice.

You can migrate checkpoint data from an existing Windows light forwarder (version 4.0 or later) to the universal forwarder. For an overview of migration, see Migrate from a light forwarder.

If you want to migrate, do so during the installation process. You cannot migrate after an installation.

You must install the universal forwarder in a different directory from the existing light forwarder. Since the default install directory for the universal forwarder is C:\Program Files\SplunkUniversalForwarder and the default install directory for full Splunk Enterprise (including the light forwarder) is C:\Program Files\Splunk, you'll be safe if you just stick with the defaults.

You perform a Windows installation with either the installer GUI or the command line:

What the installer does when you migrate a light forwarder

Whichever installation method you use, the Windows installer performs the following actions:

  • Searches for an existing heavy or light forwarder on the machine.
  • Determines whether the forwarder is eligible for migration (must be at version 4.0 or above).
  • If it finds an eligible forwarder, the GUI offers you the option of migrating. (The command line installer looks to see whether the MIGRATESPLUNK=1 flag exists.)
  • If you specify migration (or the MIGRATESPLUNK=1 flag exists), the installer shuts down any running services for the existing forwarder. It also sets the startup type of the services to manual, so that they don't start up again upon reboot.
  • Migrates the checkpoint files to the universal forwarder.
  • Completes installation and configuration of the universal forwarder.

Perform additional configuration after the migration completes

At the end of this process, you might want to perform additional configuration on the universal forwarder. Since the migration process only copies checkpoint files, you should check or manually copy over the old forwarder inputs.conf configuration file.

Once the universal forwarder is up and running (and after you have ensured that migration worked correctly), you can uninstall the old forwarder.

Last modified on 01 December, 2021
Migrate from a light forwarder   Migrate a *nix light forwarder

This documentation applies to the following versions of Splunk® Universal Forwarder: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10, 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.1.6, 8.1.7, 8.1.8, 8.1.9, 8.1.10, 8.1.11, 8.1.12, 8.1.13, 8.1.14, 8.2.0, 8.2.1, 8.2.2, 8.2.3

Acrobat logo Download manual
Acrobat logo Download this page

Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters