topic Re: What is the difference between Splunk Enterprise and Universal Forwarder? in Getting Data In

What is the difference between Splunk Enterprise and Universal Forwarder?

bjyoti — Mon, 28 Jul 2014 10:39:20 GMT

Hi All,

I am a newbie to splunk. I have gone through a number of video tutorials on the net.
Hi All,

I would like to know what is the difference between splunk enterprise and splunk universal forwarder.

what is the difference between the functionalities ? What is the recommended splunk?

Thanks

Re: What is the difference between Splunk Enterprise and Universal Forwarder?

strive — Mon, 28 Jul 2014 11:14:40 GMT

Read these

http://www.splunk.com/view/SP-CAAAE8W
http://docs.splunk.com/Documentation/Splunk/6.1.2/Admin/TypesofSplunklicenses

The splunk universal forwarder has the license enabled/applied automatically; no additional steps are required post-installation.
With Splunk universal forwarder you can only forward data, parsing and indexing is not possible.

Re: What is the difference between Splunk Enterprise and Universal Forwarder?

bjyoti — Mon, 28 Jul 2014 11:37:31 GMT

what should I install ??

Re: What is the difference between Splunk Enterprise and Universal Forwarder?

bjyoti — Mon, 28 Jul 2014 12:08:23 GMT

What use case they support?In what case the splunk enterprise and universal forwarder should be used ?

Re: What is the difference between Splunk Enterprise and Universal Forwarder?

Jeff_Lightly_Sp — Mon, 28 Jul 2014 12:53:42 GMT

In simple, broad terms, install Enterprise on the server that will retain and index the data and do your searches from there. Install the universal forwarder on any server you wish to forward data to the Enterprise server previously mentioned. The docs that Strive mentioned will help too.

Re: What is the difference between Splunk Enterprise and Universal Forwarder?

bjyoti — Tue, 29 Jul 2014 04:42:09 GMT

Thanks Jeff 🙂

Re: What is the difference between Splunk Enterprise and Universal Forwarder?

neelamssantosh — Wed, 30 Jul 2014 12:21:38 GMT

Perfect question cocoon..

As per my knowledge, initially it was designed in perl for sys admin(UNIX guys)2005, later using python UI was developed in 2008 and now they using JSON for better UI and results.

With Enterprise, you can search for logs using splunk CherryPy web browser UI where one can search the logs ,customize the Dashboards are Configuration,etc.where you can Enjoy the beauty of Splunk.

with Forwarder, we can collect the logs and send to respective Search Head or Indexer to index the data.It doesn't have any UI as of now.

ALL THE BEST