Components and licensing issues

Indexers

The Indexers index, store, and search external data.

To participate in a distributed deployment, indexers need access to an Enterprise license. The data that indexers ingest is metered against the license.

Search heads

A search head is a Splunk Enterprise instance that manages searches.

Search heads need access to an Enterprise license.

Forwarders

Forwarders ingest data and forward that data to another forwarder or an indexer. Because data is not metered until it is indexed, forwarders do not incur license usage.

In most distributed deployments, forwarders only need a Forwarder license.

There are several types of forwarders:

  • The universal forwarder has the Forwarder license applied automatically.
  • The light forwarder must be changed manually to another license type. You can use the Forwarder license, but you must manually enable it by changing to the Forwarder license group.
  • The heavy forwarder must be changed manually to another license type. If the heavy forwarder will be performing indexing or using other Enterprise features, it must be connected to a license manager node.
Note: A forwarder can use the Free license instead of a Forwarder license, but some critical functionality is unavailable with a Free license. For example, a forwarder using a Free license cannot be a deployment client and it does not offer any authentication.

Management components

All Splunk Enterprise instances functioning as management components need access to an Enterprise license.

Management components include the deployment server, the indexer cluster manager node, the search head cluster deployer, and the monitoring console. For information on management components, see Components that help to manage your deployment.