A customer has a Universal Forwarder (UF) with an inputs.conf monitoring its splunkd.log. The data is sent through a heavy forwarder to an indexer. Where does the Index time parsing occur?

Question

Options

• AIndexer
• BUniversal forwarder
• CSearch head
• DHeavy forwarder

• A
  4% (1)
• B
  11% (3)
• C
  4% (1)
• D
  82% (23)

Explanation

Heavy Forwarders (HFs) are full Splunk instances that perform index-time parsing - including line breaking, timestamp extraction, and event processing - before forwarding data downstream. When an HF sits between a UF and an indexer, it assumes the parsing role, offloading that work from the indexer.

Why the distractors are wrong:

• (A) Indexer - The indexer would do index-time parsing if data came directly from a UF, but the presence of an HF in the pipeline shifts that responsibility to the HF.
• (B) Universal Forwarder - UFs are intentionally lightweight; they forward raw data without performing any index-time parsing.
• (C) Search head - Search heads only perform search-time processing (field extraction, lookups, etc.), never index-time parsing.

Memory tip: Associate "Heavy" with "does the heavy parsing work." Whenever an HF is in the data pipeline, it acts like a mini-indexer mid-stream - parsing happens at the last full Splunk instance before the indexer, which in this case is the HF.

No community discussion yet for this question.