Which Splunk component requires a Forwarder license?
Which Splunk component requires a Forwarder license?
The correct component that requires a Forwarder license is the Universal Forwarder. Universal forwarders include a built-in Forwarder license which allows them to forward data but not perform indexing. Heavy forwarders, on the other hand, require an Enterprise license when performing additional functions such as parsing or indexing data.
B is correct Data Admin - Slide 83 System Admin - Slide 42
I agree, on system admin - slide 44 it says: Forwarder license: Sets the server up as a heavy forwarder.
This is a tricky question, because both HF and UF require a license, but the question asks which require a Forwarder License. The HF uses a Enterprise License to be able to parse or index data. The UF comes with a built-in license, but it is a license for forwarding. So when they ask which component requires a Forwarder License, it's the UF Correct answer is D.
I think D too because https://docs.splunk.com/Documentation/Splunk/8.0.1/Admin/Distdeploylicenses "***Universal forwarders only need a Forwarder license.*** If a heavy forwarder is performing additional functions such as indexing data or managing searches, it requires access to an Enterprise license."
It should be B as • Forwarder license – Sets the server up as a heavy forwarder – Applies to non-indexing forwarders – Allows authentication, but no indexing
HF requires Enterprise License UF comes with a free "Forwarding License"
This question is worded wrong. It should be asking which forwarding component requires it's own licence. The answer then would be D UF. The HF uses pool licence (ie enterprise licence). This question is also covered in Splunk Architect. I would go D UF
The HF Requires a Splunk Enterprise Instance with the Forwarder License enabled. The UF is provided as separate installation with a built-in license
It's B. See P42 on the latest Sys Admin pdf or P67 on the Data Admin pdf. "Forwarder License sets the server up as heavy forwarder"
UF is the answer. refer to this: https://docs.splunk.com/Splexicon:Forwardinglicense The universal forwarder package includes its own license. The license is enabled or applied automatically. This license allows forwarding but not indexing of unlimited data, and also enables security on the forwarder so that users must supply a user name and password to access it. The heavy forwarder should have access to an Enterprise license stack if you plan to perform indexing on the forwarder or to enable authentication on the forwarder. The light forwarder uses the same license as the universal forwarder. The light forwarder has been deprecated in Splunk Enterprise 6.2.0.
pag 47 data admin, heavy forwarder is correct
Forwarder license • Sets the server up as a heavy forwarder • Applies to non-indexing forwarders • Allows authentication, but no indexing
I was wrong, the answer is D
D is the correct answer. https://docs.splunk.com/Documentation/Splunk/8.0.1/Admin/Distdeploylicenses "***Universal forwarders only need a Forwarder license.***
https://docs.splunk.com/Documentation/Splunk/8.0.1/Admin/Distdeploylicenses "***Universal forwarders only need a Forwarder license.***
I should be D. The universal forwarder has the Forwarder license applied automatically. Heavy Forwarder has Enterprise or Forwarder license
Heavy Forwarder for sure
B is correct
UF Don´t require licence to work
Correct answer is B. UF already has an inbuilt FL and won't require it. HF need manual configuration to use FL