Migrate a *nix light forwarder
If you want to replace an existing light forwarder with a universal forwarder, you need to first migrate its checkpoint data to the new forwarder. Checkpoint data is internal data that the forwarder compiles to keep track of what data it has already forwarded to an indexer. By migrating the checkpoint data, you prevent the new universal forwarder from forwarding any data already sent by the old light forwarder. This ensures that the same data does not get indexed twice.
You can migrate checkpoint data from an existing *nix light forwarder (version 4.0 or later) to the universal forwarder. For an overview of migration, see Migrate from a light forwarder.
Install the universal forwarder into a different directory from the existing light forwarder.
You must migrate a light forwarder the first time you start the universal forwarder. It is not possible to migrate later.
1. Stop the existing forwarder:
2. Complete the basic installation of the universal forwarder. Do not start the universal forwarder yet.
3. In the universal forwarder installation directory, create a file named
old_splunk.seed. For example, if you installed the UF into
4. Edit this file so that it contains a single line that references the path of the old forwarder installationdirectory. For example, if the old forwarder was located in
/opt/splunk add the line:
5. Save the file and close it.
6. Start the universal forwarder:
The universal forwarder migrates the checkpoint files from the forwarder specified in the
$SPLUNK_HOME/old_splunk.seed file. Migration only occurs the first time you run the
start command. You can leave the
old_splunk.seed in place, The forwarder examines the file only the first time you start the forwarder after you install it.
7. Perform additional configuration of the universal forwarder, as described in Install a nix universal forwarder. Because the migration process only copies checkpoint files, review or copy over the old forwarder
inputs.conf configuration file.
8. After the universal forwarder is up and running (and after you have ensured that migration worked correctly), uninstall the old forwarder.
Migrate a Windows light forwarder
Troubleshoot the universal forwarder with Splunk Enterprise
This documentation applies to the following versions of Splunk® Universal Forwarder: 22.214.171.124, 8.2.4, 8.2.5
Feedback submitted, thanks!