is there a way to add the forward role to an existing search node

[eositis]

I have an environment where adding the forward node features to an existing node would be very convenient. sinc ethe forward node keeps the pcap data local, it would be best if I could run it on my search node, which has a ton of free space. I have a requirement where the pcap data needs to be held for a year. Any ideas on how to enable this would be appreciated.

[dougburks]

We do not provide an option to add the forward role to an existing search node. If you were doing a new installation, you would have the option of a heavy node which is essentially a forward node and a search node. However, heavy nodes are not recommended for most users as shown in the documentation:
https://docs.securityonion.net/en/2.4/architecture.html#heavy-node