When should a Universal Forwarder be used instead of a Heavy Forwarder?

Question

Options

• AWhen most of the data requires masking.
• BWhen there is a high-velocity data source.
• CWhen data comes directly from a database server.
• DWhen a modular input is needed.

• A
  2% (1)
• B
  87% (41)
• C
  4% (2)
• D
  6% (3)

Explanation

According to the Splunk blog1, the Universal Forwarder is ideal for collecting data from high-velocity data sources, such as a syslog server, due to its smaller footprint and faster performance. The Universal Forwarder performs minimal processing and sends raw or unparsed data to the indexers, reducing the network traffic and the load on the forwarders. The other options are false because: When most of the data requires masking, a Heavy Forwarder is needed, as it can perform advanced filtering and data transformation before forwarding the data2. When data comes directly from a database server, a Heavy Forwarder is needed, as it can run modular inputs such as DB Connect to collect data from various databases2. When a modular input is needed, a Heavy Forwarder is needed, as the Universal Forwarder does not include a bundled version of Python, which is required for most modular inputs2.

No community discussion yet for this question.