Set up an Edge Processor in hybrid mode

Deploy hybrid mode in order to achieve feature parity with Heavy Forwarders

Overview

Install an Edge Processor (EP) deployment in hybrid mode. Hybrid mode enables parity with Heavy Forwarder (HF) parsing capabilities, allowing for time-stamping, line-breaking, and S2S ACK at ingestion time. This reduces indexing costs and improves data pipeline efficiency without rearchitecting existing infrastructure.

For information about sidecars, see the About Splunk sidecars topic in the Splunk Enterprise Admin Manual.

Prerequisites

Prerequisites

Before modifying your infrastructure, ensure your environment meets the following requirements:

  • Edge Processor requirements: Ensure that your deployment meets the minimum software requirements to run an Edge Processor. For more information, see the Installation requirements for Edge Processors topic in this manual.

  • Supported forwarder versions: Existing heavy forwarders must be version 10.4.1 or higher.

  • Port requirements: An available port in ephemeral range (49152-65535) for dynamic inter-process communication.​ Your heavy forwarder management/REST port must be enabled and reachable on localhost​.

  • Resource audit: Compare existing node resources against the baseline requirements provided in the Data Management (DM) dashboard. For more information, see the Sizing guidelines for Edge Processors topic in this manual.

  • Host requirements: Ensure the target host has root or sudo access and the following tools: curl, tar, gzip, bash, grep, and sha512sum.

  • Forwarder requirements:Installing hybrid mode on an existing Heavy Forwarder (HF) allows the Edge Processor to manage your forwarder's inputs, outputs, and TLS configurations. The Edge Processor overwritesinputs.confandoutputs.confinsystem/local, and may clear conflictingsslRootCAPathsettings inserver.conf.

  • In Hybrid mode, automatic line breaking is disabled. To ensure your data is parsed correctly, you must manage source type configurations directly on the Heavy Forwarder (HF)

    • All files are backed up with a.bakextension before changes occur.

Forwarder requirements

Installing hybrid mode on an existing Heavy Forwarder (HF) allows the Edge Processor to manage your forwarder's inputs, outputs, and TLS configurations. The Edge Processor overwritesinputs.confandoutputs.confinsystem/local, and may clear conflictingsslRootCAPathsettings inserver.conf.

In Hybrid mode, automatic line breaking is disabled. To ensure your data is parsed correctly, you must manage source type configurations directly on the Heavy Forwarder (HF).

All files are backed up with a.bakextension before changes occur.

Deployment steps

Perform the following steps to install and configure Edge Processor hybrid mode.

Install and configure Edge Processor hybrid mode on a new or existing Splunk heavy forwarder. You can also remove hybrid mode while retaining or deleting the heavy forwarder installation.

Choose the procedure that applies to your deployment:

Before you begin

  • Obtain the complete Edge Processor hybrid installation script.
  • Confirm that the host can download the heavy forwarder package from the external repository.
  • Determine whether a Splunk heavy forwarder is already installed. If one is installed, record its version and installation path.
  • Back up your heavy forwarder's configurations, especially server.conf, inputs.conf, and outputs.conf.
  • Plan for the heavy forwarder to stop and restart during installation or removal.
  • Decide how to configure the Splunk administrator username and password. The hybrid installation script does not perform the initial credential setup.

Install hybrid mode with a new heavy forwarder

  1. Copy the complete Edge Processor hybrid installation script.
  2. Run the script on the target host.
  3. When prompted to download the latest supported Splunk heavy forwarder, select Yes.
    Note: Selecting No exits the installation.
  4. Allow the script to download, verify, and extract the heavy forwarder package.
  5. Initialize the new heavy forwarder manually:
    1. Accept the Splunk license.
    2. Complete the first-time setup.
    3. Configure the administrator credentials using the method appropriate for your deployment, such as an interactive prompt or a password file.
  6. Start the heavy forwarder and verify that its initial setup completed successfully.
  7. Run the Edge Processor hybrid installation script again.
  8. Complete the steps in Install hybrid mode on a supported heavy forwarder.

Install hybrid mode on a supported heavy forwarder

  1. Copy and run the complete Edge Processor hybrid installation script on the host.
  2. Verify that the script detects the correct heavy forwarder installation path.
  3. Review the warning message about the configuration changes that EP hybrid mode will make. Hybrid mode overwrites the inputs.conf and outputs.conf files in $SPLUNK_HOME/etc/system/local so that Edge Processor can manage inputs and outputs. Your existing versions are backed up first.

  4. When prompted to install the Edge Processor sidecar in hybrid mode, select Yes.

  5. Review the SSL root CA path warning.
    • The hybrid installation overrides the user-defined SSL root CA path so that Edge Processor can manage it.
    • Existing user-defined SSL root CA settings no longer apply after the override.
    • Select Yes to override the existing user-defined SSL root CA path, so Edge Processor can manage it. Your current server.conf configurations are backed up before the change, and the existing SSL root CA setting no longer applies after the override.
  6. Select Yes to accept the SSL root CA path change.
  7. Allow the script to stop the heavy forwarder, install the Edge Processor sidecar, and restart the heavy forwarder.
  8. Wait for the installation to finish.
  9. In the management interface, verify that the new instance appears and that its instance type is Hybrid.

The heavy forwarder is running and the Edge Processor sidecar is installed in hybrid mode.

Install hybrid mode on an unsupported older heavy forwarder

  1. Copy and run the complete Edge Processor hybrid installation script on the host.
  2. Verify that the script detects the existing heavy forwarder and its installation path.
  3. If the script reports that the heavy forwarder version is too old, allow the script to exit.
  4. Upgrade the heavy forwarder separately to the currently supported version.
    Note: The hybrid installation script does not upgrade the heavy forwarder.
  5. Start the upgraded heavy forwarder and verify that it is running normally.
  6. Run the Edge Processor hybrid installation script again.
  7. Complete the steps in Install hybrid mode on a supported heavy forwarder.

Remove Edge Processor hybrid mode

  1. Run the same script that you used to install hybrid mode.
  2. Verify that the script detects the heavy forwarder where Edge Processor hybrid mode is installed.
  3. Select the option to uninstall Edge Processor hybrid mode.
  4. Allow the script to stop the heavy forwarder and remove or offboard the Edge Processor sidecar.
  5. When prompted to permanently delete the entire heavy forwarder directory, select one of the following options:
    • Select No, the default, to retain the heavy forwarder installation.
    • Select Yes only if you also want to permanently remove the heavy forwarder and its directory.
  6. If you retain the heavy forwarder, select Yes when prompted to restart it and complete the changes.

    If you retain the heavy forwarder, the script shows you which configuration files it will revert (inputs.conf, outputs.conf, and server.conf, based on the backups it made during installation). it then asks you to confirm these changes. Select Yes, (default), to revert those files.

  7. Select Yes when prompted, to restart the heavy forwarder and complete the changes.

  8. Verify that the Edge Processor hybrid is removed and that the retained heavy forwarder is running.
  9. Review server.conf, inputs.conf, and outputs.conf to confirm that the restored .conf files are correct.
Important: The uninstall process does not retain backup copies of the original heavy forwarder configuration files. Restore any required settings from the backup that you created before installation.

Verify the result

After installing or upgrading hybrid mode, confirm the following:

  • The heavy forwarder is running after the restart.
  • The Edge Processor sidecar is installed.
  • The management interface shows a ready instance with the Hybrid instance type.

After removing hybrid mode, confirm the following:

  • The Edge Processor sidecar is no longer installed.

  • Check the management interface so see if the EP hybrid instance has been removed.

  • The heavy forwarder is either retained and running or intentionally deleted.
  • You reviewed, and, where necessary, restored residual configuration changes.