SPLK-3003 · Question #77
The universal forwarder (UF) should be used whenever possible, as it is smaller and more efficient. In which of the following scenarios would a heavy forwarder (HF) be a more appropriate choice?
The correct answer is A. When a predictable version of Python is required. Use the universal forwarder whenever possible, it is smaller and more efficient. Only use a heavy - The UI is needed - Advanced event-level routing is needed - You are filtering more than 80% of incoming events - Anonymizing or masking data before forwarding to indexer…
Question
The universal forwarder (UF) should be used whenever possible, as it is smaller and more efficient. In which of the following scenarios would a heavy forwarder (HF) be a more appropriate choice?
Options
- AWhen a predictable version of Python is required.
- BWhen filtering 10%""15% of incoming events.
- CWhen monitoring a log file.
- DWhen running a script.
How the community answered
(44 responses)- A84% (37)
- B5% (2)
- C9% (4)
- D2% (1)
Explanation
Use the universal forwarder whenever possible, it is smaller and more efficient. Only use a heavy - The UI is needed - Advanced event-level routing is needed - You are filtering more than 80% of incoming events - Anonymizing or masking data before forwarding to indexer - Predictable version of Python is needed - Required by an app/modular input (HEC, DBX, Checkpoint OPSEC LEA)
Topics
Community Discussion
No community discussion yet for this question.