We are running heavy forwarders to accept events from a number of universal forwarders, do some transforms and filtering with props and transforms, and then send them to our indexers.
We'd like to use the forwarder license on them, so we don't have to enable a connection to our license master. What capabilities are enabled with this license? Or more specific, are the functions of the parsing, merging and typing pipelines, according to [HowIndexingWorks][1], available with the forwarding license?
[1]: https://wiki.splunk.com/Community:HowIndexingWorks
↧