Which forwarder type can parse data prior to forwarding?

The correct answer is D. Heavy forwarder. The Heavy Forwarder is a full Splunk Enterprise instance configured to forward data, and it has the full parsing pipeline available - it can parse, filter, mask, route, and index data before forwarding to an indexer. The Universal Forwarder is a lightweight agent that intentional

Splunk Forwarding

Question

Options

AUniversal forwarder
BHeaviest forwarder
CHyper forwarder
DHeavy forwarder

How the community answered

(51 responses)

A
2% (1)
B
2% (1)
C
6% (3)
D
90% (46)

Explanation

The Heavy Forwarder is a full Splunk Enterprise instance configured to forward data, and it has the full parsing pipeline available - it can parse, filter, mask, route, and index data before forwarding to an indexer. The Universal Forwarder is a lightweight agent that intentionally cannot parse data to keep its footprint small. 'Heaviest forwarder' and 'Hyper forwarder' are not real Splunk product types.

Topics

#Heavy forwarder#Forwarder types#Data parsing#Forwarder capabilities

Community Discussion

No community discussion yet for this question.

Full SPLK-1003 Practice