Migrate from a light forwarder
This topic discusses migrating from a light forwarder to the universal forwarder.
The universal forwarder provides the functionality of the old light forwarder but in a smaller footprint with better performance. Therefore, you might want to migrate your existing light forwarder installations to universal forwarders. Splunk provides tools that ease the migration process and ensure that the new universal forwarder does not send an indexer any data already sent by the old light forwarder.
You can migrate from light forwarders of version 4.0 or later of Splunk Enterprise.
How to migrate a forwarder
Migration is available as an option during the universal forwarder installation process. See "Migrate a Windows forwarder" or "Migrate a nix forwarder" for specific migration instructions. Once you successfully complete the migration and confirm that the universal forwarder is active, uninstall the old light forwarder.
What migration does
Migration copies checkpoint data, including the fishbucket directory, from the old forwarder to the new universal forwarder. This prevents the universal forwarder from re-forwarding data that the previous forwarder had already sent to an indexer. This in turn avoids unnecessary re-indexing, ensuring that you maintain your statistics and keep your license usage under control.
What migration does not do
Migration does not copy any configuration files, such as
outputs.conf. This is because it would not be possible to conclusively determine where all existing versions of configuration files reside on the old forwarder. Therefore, you still need to configure your data inputs and outputs, either during installation or later. If you choose to configure later, you can copy over the necessary configuration files manually or you can use the deployment server to push them out to all your universal forwarders. See "Configure the universal forwarder" for more information on configuration files.
If the data inputs for the universal forwarder differ from the old forwarder, you can still migrate. The universal forwarder ignores migrated checkpoint data that pertains to any unconfigured inputs. If you decide to add those inputs later, the universal forwarder uses the migrated checkpoints to determine where in the data stream to start forwarding.
Migration also does not copy over any apps from the light forwarder. If you have any apps that you want to migrate to the universal forwarder, you must do so manually.
Consolidate data from multiple machines
Deploy a Windows universal forwarder via the installer GUI
This documentation applies to the following versions of Splunk® Enterprise: 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.3.14, 6.4.0