Splunk® Enterprise

Forwarding Data

Acrobat logo Download manual as PDF

Splunk Enterprise version 6.x is no longer supported as of October 23, 2019. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Acrobat logo Download topic as PDF

Migrate from a light forwarder

This topic discusses migrating from a light forwarder to the universal forwarder.

The universal forwarder provides the functionality of the old light forwarder but in a smaller footprint with better performance. Therefore, you might want to migrate your existing light forwarder installations to universal forwarders. Splunk provides tools that ease the migration process and ensure that the new universal forwarder does not send an indexer any data already sent by the old light forwarder.

You can migrate from light forwarders of version 4.0 or later of Splunk Enterprise.

How to migrate a forwarder

Migration is available as an option during the universal forwarder installation process. See "Migrate a Windows forwarder" or "Migrate a nix forwarder" for specific migration instructions. Once you successfully complete the migration and confirm that the universal forwarder is active, uninstall the old light forwarder.

What migration does

Migration copies checkpoint data, including the fishbucket directory, from the old forwarder to the new universal forwarder. This prevents the universal forwarder from re-forwarding data that the previous forwarder had already sent to an indexer. This in turn avoids unnecessary re-indexing, ensuring that you maintain your statistics and keep your license usage under control.

What migration does not do

Migration does not copy any configuration files, such as inputs.conf or outputs.conf. This is because it would not be possible to conclusively determine where all existing versions of configuration files reside on the old forwarder. Therefore, you still need to configure your data inputs and outputs, either during installation or later. If you choose to configure later, you can copy over the necessary configuration files manually or you can use the deployment server to push them out to all your universal forwarders. See "Configure the universal forwarder" for more information on configuration files.

If the data inputs for the universal forwarder differ from the old forwarder, you can still migrate. The universal forwarder ignores migrated checkpoint data that pertains to any unconfigured inputs. If you decide to add those inputs later, the universal forwarder uses the migrated checkpoints to determine where in the data stream to start forwarding.

Migration also does not copy over any apps from the light forwarder. If you have any apps that you want to migrate to the universal forwarder, you must do so manually.

Last modified on 24 July, 2015
Consolidate data from multiple machines
Deploy a Windows universal forwarder via the installer GUI

This documentation applies to the following versions of Splunk® Enterprise: 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.3.14, 6.4.0

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters