Which Splunk component requires a Forwarder license?

The correct answer is B. Heavy forwarder. Heavy forwarders require a Forwarder license because they perform indexer-like functions such as parsing, event breaking, and data routing before sending data to an indexer. Universal forwarders, by contrast, are entirely free and come with a built-in license that allows…

Splunk Forwarding

Question

Options

ASearch head
BHeavy forwarder
CHeaviest forwarder
DUniversal forwarder

How the community answered

(26 responses)

B
92% (24)
C
4% (1)
D
4% (1)

Explanation

Heavy forwarders require a Forwarder license because they perform indexer-like functions such as parsing, event breaking, and data routing before sending data to an indexer. Universal forwarders, by contrast, are entirely free and come with a built-in license that allows unlimited data forwarding with no additional licensing cost. The search head requires an Enterprise license, not a Forwarder license. 'Heaviest forwarder' is not a real Splunk component.

Topics

#Forwarder licensing#Heavy forwarder#Splunk components#Licensing requirements

Community Discussion

No community discussion yet for this question.

Full SPLK-1003 Practice