Splunk® Enterprise

Forwarding Data

Acrobat logo Download manual as PDF

Splunk Enterprise version 6.x is no longer supported as of October 23, 2019. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Acrobat logo Download topic as PDF

Deploy a light forwarder

Note: The light forwarder has been deprecated in Splunk Enterprise version 6.0. For a list of all deprecated features, see the topic "Deprecated features" in the Release Notes.

To enable forwarding and receiving, you configure both a receiver and a forwarder. The receiver is the Splunk Enterprise instance receiving the data; the forwarder sends data to the receiver.

You must first set up the receiver. You can then set up forwarders to send data to that receiver.

Setting up a light forwarder is a two step process:

1. Install a full Splunk Enterprise instance.

2. Enable forwarding on the instance.

The sections that follow describe these steps in detail.

Important: This topic describes deployment and configuration issues specific to light forwarders. For information on how to deploy a universal forwarder, see "Universal forwarder deployment overview".

Install a full Splunk Enterprise instance

To deploy a light forwarder, you must first install a full Splunk Enterprise instance. For detailed information about installing Splunk Enterprise, including system requirements and licensing issues, see the Installation manual.

Once the instance has been installed, you can enable light forwarder functionality on it.

Note: When you install a Splunk Enterprise instance to be used as a light forwarder, select the forwarder license. For more information, see "Types of Splunk licenses".

Set up forwarding

You can use the CLI as a quick way to enable forwarding.

You can also enable, as well as configure, forwarding by creating an outputs.conf file on the Splunk Enterprise instance. Although setting up forwarders with outputs.conf requires a bit more initial knowledge, there are obvious advantages to performing all forwarder configurations in a single location. Most advanced configuration options are available only through outputs.conf. In addition, if you will be enabling and configuring a number of forwarders, you can easily accomplish this by editing a single outputs.conf file and making a copy for each forwarder. See the topic "Configure forwarders with outputs.conf" for more information.

Set up light forwarding with the CLI

With the CLI, setting up forwarding is a two step process. First you enable forwarding on the instance. Then you start forwarding to a specified receiver.

To access the CLI, first navigate to $SPLUNK_HOME/bin/.

To enable the light forwarder mode, enter:

splunk enable app SplunkLightForwarder -auth <username>:<password>

To disable the light forwarder mode, enter:

splunk disable app SplunkLightForwarder -auth <username>:<password>

By disabling forwarding, this command reverts the forwarder to a full Splunk Enterprise instance.

Important: After invoking either of these commands, restart the forwarder.

Start forwarding activity from the CLI

To access the CLI, first navigate to $SPLUNK_HOME/bin/.

To start forwarding activity, specify the receiver with the splunk add forward-server command:

splunk add forward-server <host>:<port> -auth <username>:<password>

To end forwarding activity, enter:

splunk remove forward-server <host>:<port> -auth <username>:<password>

Note: Although this command ends forwarding activity, the instance remains configured as a forwarder. To revert the instance to a full Splunk Enterprise instance, use the disable command, as described earlier in this topic.

Important: After invoking either of these commands, restart the forwarder.

Upgrade a forwarder

To upgrade a forwarder to a new version, just upgrade the instance in the usual fashion. For details, read the upgrade section of the Installation manual.

Important: Before doing an upgrade, consider whether you really need to. In many cases, there's no compelling reason to upgrade a forwarder. Forwarders are always compatible with later version indexers, so you do not need to upgrade them just because you've upgraded the indexers they're sending data to.

Back up your files first

Before you perform the upgrade, we strongly recommend that you back up all of your files. Most importantly, back up your configuration files. For information on backing up configurations, read "Back up configuration information" in the Admin manual.

Last modified on 27 January, 2016
Deploy a heavy forwarder
Heavy and light forwarder capabilities

This documentation applies to the following versions of Splunk® Enterprise: 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.3.14

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters