Which Splunk forwarder type allows parsing of data before forwarding to an indexer?

The correct answer is C. Heavy forwarder. Heavy forwarders are essentially full Splunk installations with most indexing features enabled. They can parse data (perform event breaking, timestamp extraction, field extraction, and apply transforms) before forwarding the processed data to an indexer. Universal forwarders…

Splunk Forwarding

Question

Options

AUniversal forwarder
BParsing forwarder
CHeavy forwarder
DAdvanced forwarder

How the community answered

(23 responses)

A
4% (1)
B
4% (1)
C
91% (21)

Explanation

Heavy forwarders are essentially full Splunk installations with most indexing features enabled. They can parse data (perform event breaking, timestamp extraction, field extraction, and apply transforms) before forwarding the processed data to an indexer. Universal forwarders are lightweight and intentionally strip out parsing capabilities to minimize resource usage - they send raw or lightly processed data. 'Parsing forwarder' and 'Advanced forwarder' are not valid Splunk forwarder types.

Topics

#Forwarder types#Heavy forwarder#Data parsing#Parsing before forwarding

Community Discussion

No community discussion yet for this question.

Full SPLK-1003 Practice