Migrate a Windows light forwarder
If you want to replace an existing light forwarder with a universal forwarder, you need to first migrate its checkpoint data to the new forwarder. Checkpoint data is internal data that the forwarder compiles to keep track of what data it has already forwarded to an indexer. By migrating the checkpoint data, you prevent the new universal forwarder from forwarding any data already sent by the old light forwarder. This ensures that the same data does not get indexed twice.
You can migrate checkpoint data from an existing Windows light forwarder (version 4.0 or later) to the universal forwarder. For an overview of migration, see "Migrating from a light forwarder" in the Deployment Overview.
If you want to migrate, you must do so during the installation process. You cannot migrate post-installation.
You perform a Windows installation with either the installer GUI or the commandline:
- If you use the installer GUI, one of the screens will prompt you to migrate. See "Deploy a Windows universal forwarder via the installer GUI" for a walkthrough of the GUI installation procedure.
- If you install via the commandline, the flag
MIGRATESPLUNK=1specifies migration. See "Deploy a Windows universal forwarder via the commandline" for a list of supported flags and how to use them to configure your installation.
Important: You must install the universal forwarder in a different directory from the existing light forwarder. Since the default install directory for the universal forwarder is
C:\Program Files\SplunkUniversalForwarder and the default install directory for full Splunk Enterprise (including the light forwarder) is
C:\Program Files\Splunk, you'll be safe if you just stick with the defaults.
What the installer does
Whichever installation method you use, the Windows installer performs the following actions:
1. Searches for an existing heavy or light forwarder on the machine.
2. Determines whether the forwarder is eligible for migration (must be at version 4.0 or above).
3. If it finds an eligible forwarder, the GUI offers the user the option of migrating. (The commandline installer looks to see whether the
MIGRATESPLUNK=1 flag exists.)
4. If user specifies migration (or the
MIGRATESPLUNK=1 flag exists), the installer shuts down any running services (splunkd and, if running, splunkweb) for the existing forwarder. It also sets the startup type of the services to manual, so that they don't start up again upon reboot.
5. Migrates the checkpoint files to the universal forwarder.
6. Completes installation and configuration of the universal forwarder.
What you need to do
At the end of this process, you might want to perform additional configuration on the universal forwarder. Since the migration process only copies checkpoint files, you will probably want to manually copy over the old forwarder's
inputs.conf configuration file (or at least examine it, to determine what data inputs it was monitoring).
Once the universal forwarder is up and running (and after you've tested to ensure migration worked correctly), you can uninstall the old forwarder.
Make a universal forwarder part of a system image
Deploy a *nix universal forwarder manually
This documentation applies to the following versions of Splunk® Enterprise: 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, 6.0.7, 6.0.8, 6.0.9, 6.0.10, 6.0.11, 6.0.12, 6.0.13, 6.0.14, 6.0.15, 6.1, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6, 6.1.7, 6.1.8, 6.1.9, 6.1.10, 6.1.11, 6.1.12, 6.1.13, 6.1.14, 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.2.9, 6.2.10, 6.2.11, 6.2.12, 6.2.13, 6.2.14, 6.2.15