This is a tricky question, because both HF and UF require a license, but the question asks which require a Forwarder License.
The HF uses a Enterprise License to be able to parse or index data.
The UF comes with a built-in license, but it is a license for forwarding.
So when they ask which component requires a Forwarder License, it's the UF
Correct answer is D.
I think D too because https://docs.splunk.com/Documentation/Splunk/8.0.1/Admin/Distdeploylicenses
"***Universal forwarders only need a Forwarder license.***
If a heavy forwarder is performing additional functions such as indexing data or managing searches, it requires access to an Enterprise license."
D
check official documentation
Universal forwarders only need a Forwarder license. If a heavy forwarder is performing additional functions such as indexing data or managing searches, it requires access to an Enterprise license.
https://docs.splunk.com/Documentation/Splunk/8.0.1/Admin/Distdeploylicenses
The correct answer is A and D assuming the HF is set up as non-indexing. According to the course for the exam, "sets the server up as a heavy forwarder" probably means they would be looking for the HF as the answer, even though the UF is technically more correct
In both the Ent Admin and Data Admin slide decks, any reference to the phrase "Forwarder License", is attached to comment about the HF not the UF. Answer B.
Correct answer seems to be B, a Forwarding License is a license for a forwarder, which is a Splunk Enterprise instance that forwards data to another Splunk Enterprise server or to a third-party system.
In this case the HF is a Splunk Enterprise instance forwarding data, "The heavy forwarder should have access to an Enterprise license stack if you plan to perform indexing on the forwarder or to enable authentication on the forwarder." A "stack" is a collection of licenses, meaning that the forwarding license is required and included in the stack
D is correct, as the documentation provided below says, ¨Universal forwarders only need a Forwarder license. If a heavy forwarder is performing additional functions such as indexing data or managing searches, it requires access to an Enterprise license.¨
https://docs.splunk.com/Documentation/Splunk/9.3.1/Admin/Distdeploylicenses#:~:text=Universal%20forwarders%20only%20need%20a,access%20to%20an%20Enterprise%20license.
In the question only the UF need just a forwarder license, the HFW can use the forwarder license, but also can use a Enterprise licence, in this case, by the questions , the correct would be "D"
D is the correct answer.
https://docs.splunk.com/Documentation/Splunk/8.0.1/Admin/Distdeploylicenses
"***Universal forwarders only need a Forwarder license.***
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
BMO
Highly Voted 3 years, 9 months agotjwe
3 years, 3 months agogatundu_
3 months, 2 weeks agodpharker
Highly Voted 4 years, 4 months agohappy_and_lucky
4 years, 1 month ago3bd8ac0
Most Recent 2 weeks, 1 day agoBob_Hob
3 weeks agoljackson
2 months agoAlens19
3 months, 2 weeks agoAlens19
3 months, 2 weeks agoAlens19
3 months, 2 weeks agogatundu_
4 months, 1 week agogabo1969
3 months, 3 weeks agoallahsal
12 months agoallahsal
12 months agoallahsal
12 months agoallahsal
12 months agoVidomina
12 months agobobixaka
1 year, 3 months agoemlch
2 years, 5 months agoMxQ3
2 years, 6 months agoApis
3 years, 1 month agogabo1969
3 years, 2 months ago