Deploy a light forwarder
The light forwarder was deprecated in Splunk Enterprise version 6.0. For a list of all deprecated features, see Deprecated features in the Release Notes.
You can install a light forwarder on a full Splunk Enterprise instance. For information on how to install a universal forwarder, which is the recommended replacement for the light forwarder, see Install the universal forwarder software in the Universal Forwarder manual.
To enable forwarding and receiving, configure both a receiver and a forwarder. The receiver receives the data and the forwarder sends data to the receiver.
A Splunk best practice is to set up the receiver first. You can then set up forwarders to send data to that receiver.
Setting up a light forwarder is a two-step process:
- Install a full Splunk Enterprise instance.
- Enable forwarding on the instance.
Note: When you configure a Splunk instance as a light forwarder, select the forwarder license. For more information, see Types of Splunk licenses.
Set up forwarding
You can use the CLI as a quick way to enable forwarding.
You can also enable, as well as configure, forwarding by creating an outputs.conf file on the Splunk instance. Although setting up forwarders with outputs.conf requires a bit more initial knowledge, there are obvious advantages to performing all forwarder configurations in a single location. Most advanced configuration options are available only through outputs.conf. In addition, if you will be enabling and configuring a number of forwarders, you can easily accomplish this by editing a single outputs.conf file and making a copy for each forwarder. See the topic "Configure forwarders with outputs.conf" for more information.
Set up light forwarding with the CLI
To set up light forwarding, perform the following steps:
- From a shell or command prompt, navigate to the
$SPLUNK_HOME/bin/directory and run the following command:splunk enable app SplunkLightForwarder -auth <username>:<password> - Restart the forwarder.
To disable the light forwarder mode, run the following command:
splunk disable app SplunkLightForwarder -auth <username>:<password>
This command reverts the forwarder to a full Splunk Enterprise instance.
Start forwarding activity from the CLI
- From a shell or command prompt, navigate to the
$SPLUNK_HOME/bin/directory. - To start forwarding activity, specify the receiver with the
splunk add forward-servercommand:splunk add forward-server <host>:<port> -auth <username>:<password>
To end forwarding activity, enter:
splunk remove forward-server <host>:<port> -auth <username>:<password>
Note: Although this command ends forwarding activity, the instance remains configured as a forwarder. To revert the instance to a full Splunk Enterprise instance, use the disable command, as described earlier in this topic.
After invoking either of these commands, restart the forwarder.
| Deploy a heavy forwarder | Configure data collection on forwarders with inputs.conf |
This documentation applies to the following versions of Splunk® Enterprise: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.1.5, 7.3.3, 7.3.4, 7.3.5, 7.3.7, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10, 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.1.6, 8.1.7, 8.1.8, 8.1.9, 8.1.10, 8.1.11, 8.1.12, 8.1.13, 8.1.14, 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.2.5, 7.3.6, 7.3.8, 7.3.9, 8.0.0
Download manual
Feedback submitted, thanks!