Which Splunk component requires a Forwarder license?
Which Splunk component requires a Forwarder license?
The correct component that requires a Forwarder license is the Universal Forwarder. Universal forwarders include a built-in Forwarder license which allows them to forward data but not perform indexing. Heavy forwarders, on the other hand, require an Enterprise license when performing additional functions such as parsing or indexing data.
This is a tricky question, because both HF and UF require a license, but the question asks which require a Forwarder License. The HF uses a Enterprise License to be able to parse or index data. The UF comes with a built-in license, but it is a license for forwarding. So when they ask which component requires a Forwarder License, it's the UF Correct answer is D.
I think D too because https://docs.splunk.com/Documentation/Splunk/8.0.1/Admin/Distdeploylicenses "***Universal forwarders only need a Forwarder license.*** If a heavy forwarder is performing additional functions such as indexing data or managing searches, it requires access to an Enterprise license."
B is correct Data Admin - Slide 83 System Admin - Slide 42
I agree, on system admin - slide 44 it says: Forwarder license: Sets the server up as a heavy forwarder.
It should be B as • Forwarder license – Sets the server up as a heavy forwarder – Applies to non-indexing forwarders – Allows authentication, but no indexing
This question is worded wrong. It should be asking which forwarding component requires it's own licence. The answer then would be D UF. The HF uses pool licence (ie enterprise licence). This question is also covered in Splunk Architect. I would go D UF
HF requires Enterprise License UF comes with a free "Forwarding License"
pag 47 data admin, heavy forwarder is correct
UF is the answer. refer to this: https://docs.splunk.com/Splexicon:Forwardinglicense The universal forwarder package includes its own license. The license is enabled or applied automatically. This license allows forwarding but not indexing of unlimited data, and also enables security on the forwarder so that users must supply a user name and password to access it. The heavy forwarder should have access to an Enterprise license stack if you plan to perform indexing on the forwarder or to enable authentication on the forwarder. The light forwarder uses the same license as the universal forwarder. The light forwarder has been deprecated in Splunk Enterprise 6.2.0.
It's B. See P42 on the latest Sys Admin pdf or P67 on the Data Admin pdf. "Forwarder License sets the server up as heavy forwarder"
The HF Requires a Splunk Enterprise Instance with the Forwarder License enabled. The UF is provided as separate installation with a built-in license
Correct answer is B. UF already has an inbuilt FL and won't require it. HF need manual configuration to use FL
UF Don´t require licence to work
B is correct
Heavy Forwarder for sure
I should be D. The universal forwarder has the Forwarder license applied automatically. Heavy Forwarder has Enterprise or Forwarder license
D is the correct answer. https://docs.splunk.com/Documentation/Splunk/8.0.1/Admin/Distdeploylicenses "***Universal forwarders only need a Forwarder license.***
https://docs.splunk.com/Documentation/Splunk/8.0.1/Admin/Distdeploylicenses "***Universal forwarders only need a Forwarder license.***
Forwarder license • Sets the server up as a heavy forwarder • Applies to non-indexing forwarders • Allows authentication, but no indexing
I was wrong, the answer is D