Splunk® Enterprise

Forwarding Data

Download manual as PDF

Download topic as PDF

Deploy a light forwarder

Important: The light forwarder has been deprecated in Splunk Enterprise version 6.0. For a list of all deprecated features, see Deprecated features in the Release Notes.

You can install a light forwarder on a full Splunk Enterprise instance. For information on how to install a universal forwarder, which is the recommended replacement for the light forwarder, see Install the universal forwarder software in the Universal Forwarder manual.

To enable forwarding and receiving, configure both a receiver and a forwarder. The receiver receives the data and the forwarder sends data to the receiver.

A Splunk best practice is to set up the receiver first. You can then set up forwarders to send data to that receiver.

Setting up a light forwarder is a two-step process:

  1. Install a full Splunk Enterprise instance.
  2. Enable forwarding on the instance.

Note: When you configure a Splunk instance as a light forwarder, select the forwarder license. For more information, see Types of Splunk licenses.

Set up forwarding

You can use the CLI as a quick way to enable forwarding.

You can also enable, as well as configure, forwarding by creating an outputs.conf file on the Splunk instance. Although setting up forwarders with outputs.conf requires a bit more initial knowledge, there are obvious advantages to performing all forwarder configurations in a single location. Most advanced configuration options are available only through outputs.conf. In addition, if you will be enabling and configuring a number of forwarders, you can easily accomplish this by editing a single outputs.conf file and making a copy for each forwarder. See the topic "Configure forwarders with outputs.conf" for more information.

Set up light forwarding with the CLI

To set up light forwarding, perform the following steps:

  1. From a shell or command prompt, navigate to the $SPLUNK_HOME/bin/ directory and run the following command: splunk enable app SplunkLightForwarder -auth <username>:<password>
  2. Restart the forwarder.

To disable the light forwarder mode, run the following command:

splunk disable app SplunkLightForwarder -auth <username>:<password>

This command reverts the forwarder to a full Splunk Enterprise instance.

Start forwarding activity from the CLI

  1. From a shell or command prompt, navigate to the $SPLUNK_HOME/bin/ directory.
  2. To start forwarding activity, specify the receiver with the splunk add forward-server command: splunk add forward-server <host>:<port> -auth <username>:<password>

To end forwarding activity, enter:

splunk remove forward-server <host>:<port> -auth <username>:<password>

Note: Although this command ends forwarding activity, the instance remains configured as a forwarder. To revert the instance to a full Splunk Enterprise instance, use the disable command, as described earlier in this topic.

After invoking either of these commands, restart the forwarder.

PREVIOUS
Deploy a heavy forwarder
  NEXT
Configure data collection on forwarders with inputs.conf

This documentation applies to the following versions of Splunk® Enterprise: 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.9, 6.4.10, 6.4.11, 6.5.0, 6.5.1, 6.5.1612 (Splunk Cloud only), 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.5.6, 6.5.7, 6.5.8, 6.5.9, 6.5.10, 6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.6.5, 6.6.6, 6.6.7, 6.6.8, 6.6.9, 6.6.10, 6.6.11, 6.6.12, 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.3.0


Comments

Clicking on Next from this section takes you to Universal Fowarding Documentation. May be it needs to fixed.

Prashanthr2
June 20, 2018

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters