When monitoring and forwarding events collected from a file containing unstructured textual events, what is the difference in the Splunk2Splunk payload traffic sent between a universal forwarder…

Question

Options

• AThe payload format sent from the UF versus the HF is exactly the same. The payload size is
• BThe UF sends a stream of data containing one set of medata fields to represent the entire stream,
• CThe UF will generally send the payload in the same format, but only when the sourcetype is
• DThe HF sends a stream of 64K TCP chunks with one set of metadata fields attached to represent

• A
  24% (9)
• B
  59% (22)
• C
  8% (3)
• D
  8% (3)

Explanation

Option B is correct because a Universal Forwarder performs no event parsing - it ships raw data as a continuous stream with a single set of metadata fields applied to the whole stream, leaving line-breaking and event parsing to the indexer. A Heavy Forwarder, by contrast, parses the data locally (line-breaking, timestamp extraction, etc.) before forwarding, so it sends individually delineated events, each carrying its own complete metadata fields - a fundamentally different payload structure.

Option A is wrong because the two forwarder types produce structurally different payloads: the UF sends a raw stream while the HF sends pre-parsed, per-event data. Option C is wrong because the UF's behavior is not sourcetype-conditional - it always forwards raw streams regardless of sourcetype, unless explicitly configured otherwise. Option D is wrong because it describes a raw "one metadata header for the whole chunk" pattern, which is actually closer to the UF's behavior, not the HF's.

Memory tip: Think UF = dumb pipe (one header, raw stream, indexer does the work) vs. HF = smart parser (events already parsed, each event carries its own metadata bag). The HF does the heavy lifting locally before sending.

No community discussion yet for this question.