topic Re: Splunk Heavy Forwarder in Getting Data In

Splunk Heavy Forwarder

Vladimir — Fri, 24 Jun 2011 11:08:30 GMT

Hi,

Will Splunk support heavy forwarder in future or it's going to be decommitted?
I'm asking because there are only links to Splunk and SplunkUniversalForwarder in download section.

Thanks,
Vladimir

Re: Splunk Heavy Forwarder

sseekamp — Fri, 24 Jun 2011 12:35:55 GMT

Vladimir,

The heavy forwarder is just the full install of Splunk. There is no separate download for it.

Re: Splunk Heavy Forwarder

Vladimir — Fri, 24 Jun 2011 12:40:39 GMT

So, in this case there is no advantages in using Splunk+SplunkUniversalForwarder instead of Splunk with configuring forwarding, right?

Re: Splunk Heavy Forwarder

OL — Fri, 24 Jun 2011 13:24:07 GMT

Splunk UF is way lighter and the only job it is (almost!) doing is forwarding the collected data the Splunk instance. There is no processing here. That's why it is less resource demanding.

Moreover, on the security point of view, the UF doesn't have a web UI and therefore you cannot unable it. This can be important in some cases.

Hope it helps.

Regards,
OL

Re: Splunk Heavy Forwarder

Vladimir — Fri, 24 Jun 2011 14:31:23 GMT

Thanks very much to all!