Splunk® Universal Forwarder

Forwarder Manual

This documentation does not apply to the most recent version of Splunk® Universal Forwarder. For documentation on the most recent version, go to the latest release.

Migrate a *nix light forwarder

If you want to replace an existing light forwarder with a universal forwarder, you need to first migrate its checkpoint data to the new forwarder. Checkpoint data is internal data that the forwarder compiles to keep track of what data it has already forwarded to an indexer. By migrating the checkpoint data, you prevent the new universal forwarder from forwarding any data already sent by the old light forwarder. This ensures that the same data does not get indexed twice.

You can migrate checkpoint data from an existing *nix light forwarder (version 4.0 or later) to the universal forwarder. For an overview of migration, see Migrate from a light forwarder.

Install the universal forwarder into a different directory from the existing light forwarder.

You must migrate a light forwarder the first time you start the universal forwarder. It is not possible to migrate later.

1. Stop the existing forwarder: 

   $SPLUNK_HOME/bin/splunk stop

2. Complete the basic installation of the universal forwarder. Do not start the universal forwarder yet.

3. In the universal forwarder installation directory, create a file named old_splunk.seed. For example, if you installed the UF into /opt/splunkforwarder, create /opt/splunkforwarder/old_splunk.seed.

4. Edit this file so that it contains a single line that references the path of the old forwarder installationdirectory. For example, if the old forwarder was located in /opt/splunk add the line: 

/opt/splunk

.

5. Save the file and close it.

6. Start the universal forwarder: 

   $SPLUNK_HOME/bin/splunk start

The universal forwarder migrates the checkpoint files from the forwarder specified in the $SPLUNK_HOME/old_splunk.seed file. Migration only occurs the first time you run the start command. You can leave the old_splunk.seed in place, The forwarder examines the file only the first time you start the forwarder after you install it.

7. Perform additional configuration of the universal forwarder, as described in Install a nix universal forwarder. Because the migration process only copies checkpoint files, review or copy over the old forwarder inputs.conf configuration file.

8. After the universal forwarder is up and running (and after you have ensured that migration worked correctly), uninstall the old forwarder.

Last modified on 01 December, 2021
Migrate a Windows light forwarder   Troubleshoot the universal forwarder with Splunk Enterprise

This documentation applies to the following versions of Splunk® Universal Forwarder: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10, 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.1.6, 8.1.7, 8.1.8, 8.1.9, 8.1.10, 8.1.11, 8.1.12, 8.1.13, 8.1.14, 8.2.0, 8.2.1, 8.2.2, 8.2.3

Acrobat logo Download manual
Acrobat logo Download this page

Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters