topic Re: Why do we require splunk forwarder as we can have splunk installed and splunkd service can capture everything ??? in Getting Data In

Why do we require splunk forwarder as we can have splunk installed and splunkd service can capture everything ???

rashokciet — Tue, 07 Apr 2015 04:08:41 GMT

In all our servers splunk 6.1.5 has been installed and splunkd service is capturing all the required data.So what is the use of splunk forwarder ??Is there any benefit having splunk forwarder rather than running splunkd and where do we use it???

Re: Why do we require splunk forwarder as we can have splunk installed and splunkd service can capture everything ???

gyslainlatsa — Tue, 07 Apr 2015 10:32:00 GMT

hi rashokciet,

i don't know if this resolve your problem but i know that:
splunk operates together with the splunkd server and splunkweb interface. the server works in the background while the interface allows us to visualize the data.
splunk forwarder is important in a distributed environment, in this environment we need to send data from our machine to other machines. splunk forwrder is very important in case you frequently send the output data.

please forgive my english

Re: Why do we require splunk forwarder as we can have splunk installed and splunkd service can capture everything ???

jeffland — Tue, 07 Apr 2015 11:24:51 GMT

A "splunkd" running somewhere that sends its data to another machine essentially is a fowarder; a forwarder is not something "extra": http://docs.splunk.com/Splexicon:Forwarder

Comparing the different variants of a forwarder, the benefit of a heavy forwarder as opposed to a light/universal forwarder is that it can filter your data on event level before it hits your index, so it can save you some indexing volume (and network bandwith/processing power on the indexer).

You could also make use of intermediate forwarders: http://docs.splunk.com/Documentation/Splunk/6.2.2/Forwarding/Forwarderdeploymenttopologies#Intermediate_forwarding

Re: Why do we require splunk forwarder as we can have splunk installed and splunkd service can capture everything ???

mikelanghorst — Mon, 28 Sep 2020 19:29:08 GMT

"Splunk Forwarder" is typically referring to the lighter weight install of the Splunk Universal Forwarder or UF. It has a smaller disk footprint with some functionality stripped out, and smaller memory usage. Typically if you're only reading files or running scripted inputs, such as Splunk_TA_nix, the UF is all that's needed. However as jeffland mentions there are some occasions that the full install or heavy forwarder is desired. Being able to filter unneeded data before hitting the wire, or acting as a collection node between data centers being 2 of those reasons.

Re: Why do we require splunk forwarder as we can have splunk installed and splunkd service can capture everything ???

rashokciet — Wed, 08 Apr 2015 05:11:33 GMT

Thanks gyslainlatsa

Re: Why do we require splunk forwarder as we can have splunk installed and splunkd service can capture everything ???

rashokciet — Wed, 08 Apr 2015 05:11:54 GMT

Thanks jeffland

Re: Why do we require splunk forwarder as we can have splunk installed and splunkd service can capture everything ???

rashokciet — Wed, 08 Apr 2015 05:12:53 GMT

Splunkd can handle search request and splunk forwarder cannot handle search request - Is that correct??
The searching is done by splunk web so both should handle search request ??? I am confused.

Your help was and will be appreciated.

Re: Why do we require splunk forwarder as we can have splunk installed and splunkd service can capture everything ???

jeffland — Wed, 08 Apr 2015 05:48:31 GMT

That's kinda in the right direction. I would encourage you to learn about splunk architecture to understand the different system parts and how they work together: http://www.splunk.com/view/SP-CAAABF9 and http://docs.splunk.com/Documentation/Splunk/6.2.2/Deploy/Distributedoverview