This is a tricky question, because both HF and UF require a license, but the question asks which require a Forwarder License.
The HF uses a Enterprise License to be able to parse or index data.
The UF comes with a built-in license, but it is a license for forwarding.
So when they ask which component requires a Forwarder License, it's the UF
Correct answer is D.
I think D too because https://docs.splunk.com/Documentation/Splunk/8.0.1/Admin/Distdeploylicenses
"***Universal forwarders only need a Forwarder license.***
If a heavy forwarder is performing additional functions such as indexing data or managing searches, it requires access to an Enterprise license."
Correct answer seems to be B, a Forwarding License is a license for a forwarder, which is a Splunk Enterprise instance that forwards data to another Splunk Enterprise server or to a third-party system.
In this case the HF is a Splunk Enterprise instance forwarding data, "The heavy forwarder should have access to an Enterprise license stack if you plan to perform indexing on the forwarder or to enable authentication on the forwarder." A "stack" is a collection of licenses, meaning that the forwarding license is required and included in the stack
D is correct, as the documentation provided below says, ¨Universal forwarders only need a Forwarder license. If a heavy forwarder is performing additional functions such as indexing data or managing searches, it requires access to an Enterprise license.¨
https://docs.splunk.com/Documentation/Splunk/9.3.1/Admin/Distdeploylicenses#:~:text=Universal%20forwarders%20only%20need%20a,access%20to%20an%20Enterprise%20license.
In the question only the UF need just a forwarder license, the HFW can use the forwarder license, but also can use a Enterprise licence, in this case, by the questions , the correct would be "D"
D is the correct answer.
https://docs.splunk.com/Documentation/Splunk/8.0.1/Admin/Distdeploylicenses
"***Universal forwarders only need a Forwarder license.***
This question is worded wrong. It should be asking which forwarding component requires it's own licence. The answer then would be D UF. The HF uses pool licence (ie enterprise licence). This question is also covered in Splunk Architect.
I would go D UF
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
dpharker
Highly Voted 4 years, 1 month agohappy_and_lucky
3 years, 10 months agoBMO
Highly Voted 3 years, 5 months agotjwe
3 years agogatundu_
1 week, 6 days agoAlens19
Most Recent 2 weeks agoAlens19
2 weeks agoAlens19
2 weeks agogatundu_
1 month, 1 week agogabo1969
3 weeks, 2 days agoallahsal
8 months, 4 weeks agoallahsal
8 months, 3 weeks agoallahsal
8 months, 4 weeks agoallahsal
8 months, 4 weeks agoVidomina
8 months, 4 weeks agobobixaka
1 year agoemlch
2 years, 2 months agoMxQ3
2 years, 3 months agoApis
2 years, 10 months agogabo1969
2 years, 11 months agoinwigboji
3 years, 1 month agonot_another_user_007
3 years, 2 months agoloky0
3 years, 2 months ago