A customer has a network device that transmits logs directly with UDP or TCP over SSL. Using PS best practices, which ingestion method should be used?

Question

Options

• AOpen a TCP port with SSL on a heavy forwarder to parse and transmit the data to the indexing
• BOpen a UDP port on a universal forwarder to parse and transmit the data to the indexing tier.
• CUse a syslog server to aggregate the data to files and use a heavy forwarder to read and transmit
• DUse a syslog server to aggregate the data to files and use a universal forwarder to read and

• B
  14% (2)
• C
  7% (1)
• D
  79% (11)

Explanation

Option D is correct because Splunk best practices recommend using a dedicated syslog server (e.g., rsyslog or syslog-ng) to receive and write UDP/TCP/SSL traffic to disk files, then deploying a lightweight Universal Forwarder (UF) to tail those files and forward data to the indexing tier - this decouples ingestion from forwarding and is reliable, scalable, and resource-efficient.

Why the distractors are wrong:

• A is wrong because Heavy Forwarders are resource-heavy and should only be used when parsing/routing logic is required; a UF suffices here, making the HF overkill.
• B is wrong because Universal Forwarders are not designed to listen on network ports for syslog; their role is reading files or forwarding data, not acting as a network receiver.
• C has the right architecture (syslog server + file reading) but uses a Heavy Forwarder unnecessarily - since no intermediate parsing or transformation is needed, a UF is the preferred and leaner choice.

Memory tip: Think "syslog catches, UF dispatches" - let the syslog server handle all network protocol complexity (UDP/TCP/SSL), write to files, and let the Universal Forwarder do what it does best: read files and forward. Only reach for the Heavy Forwarder when you need to transform or route data mid-stream.

No community discussion yet for this question.