Migrate from a light forwarder

The universal forwarder provides the functionality of the light forwarder but in a smaller resource footprint with better performance. You can migrate your existing light forwarder installations to universal forwarders. Splunk provides tools that ease the migration process and ensure that the new universal forwarder does not send an indexer any data already sent by the old light forwarder.

You can migrate from light forwarders of version 4.0 or later of Splunk Enterprise.

How to migrate a forwarder

Migration is available as an option during the universal forwarder installation process. See Migrate a Windows light forwarder or Migrate a nix light forwarder for migration instructions. After you complete the migration and confirm that the universal forwarder is active, uninstall the old light forwarder.

What migration does

Migration copies checkpoint data, including the fishbucket directory, from the old forwarder to the new universal forwarder. This prevents the universal forwarder from resending data that the previous forwarder had already sent to an indexer. This in turn avoids unnecessary re-indexing, ensuring that you maintain your statistics and keep your license usage under control.

What migration does not do

Migration does not copy any configuration files, such as inputs.conf or outputs.conf. This is because it would not be possible to conclusively determine where all existing versions of configuration files reside on the old forwarder. Therefore, you still need to configure your data inputs and outputs, either during installation or later. If you choose to configure later, you can copy over the necessary configuration files manually or you can use the deployment server to push them out to all your universal forwarders. See Deploy the Universal Forwarder for information on configuration files.

If the data inputs for the universal forwarder differ from the old forwarder, you can still migrate. The universal forwarder ignores migrated checkpoint data that pertains to any unconfigured inputs. If you decide to add those inputs later, the universal forwarder uses the migrated checkpoints to determine where in the data stream to start forwarding.

Migration also does not copy over any apps from the light forwarder. If you have any apps that you want to migrate to the universal forwarder, you must do so manually.