https://community.splunk.com/t5/Getting-Data-In/What-are-the-main-differences-between-the-Universal-forwarder/m-p/338380#M62459 <P>Can someone explain me in simply english the difference between there two forwards and where they are using?</P> Mon, 30 Oct 2017 21:17:08 GMT test_qweqwe 2017-10-30T21:17:08Z https://community.splunk.com/t5/Getting-Data-In/What-are-the-main-differences-between-the-Universal-forwarder/m-p/338380#M62459 <P>Can someone explain me in simply english the difference between there two forwards and where they are using?</P> Mon, 30 Oct 2017 21:17:08 GMT https://community.splunk.com/t5/Getting-Data-In/What-are-the-main-differences-between-the-Universal-forwarder/m-p/338380#M62459 test_qweqwe 2017-10-30T21:17:08Z https://community.splunk.com/t5/Getting-Data-In/What-are-the-main-differences-between-the-Universal-forwarder/m-p/338381#M62460 <P>Generally description from below link would answer your question.<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.6.3/Forwarding/Typesofforwarders">http://docs.splunk.com/Documentation/Splunk/6.6.3/Forwarding/Typesofforwarders</A></P> <P>If not, a universal forwarder only does the collection and forwarding of data (collects data and sends to other Splunk instance where it'll be processed). It doesn't do data processing (event parsing, timestamp extractions , routing, masking etc) with exception of structured data types such as json, Whereas a heavy forwarder, as name suggests, does collection, processing and forwarding. A heavy forwarder can also do local indexing if configured to do so. Detailed differences can be found here: <A href="http://docs.splunk.com/Documentation/Splunk/6.6.3/Forwarding/Typesofforwarders#Forwarder_comparison">http://docs.splunk.com/Documentation/Splunk/6.6.3/Forwarding/Typesofforwarders#Forwarder_comparison</A></P> <P>In most use-cases of data forwarding, you would use Universal forwarder and leave data processing to intermediate heavy forwarders/indexers. In cases where you want to do local indexing OR keep the data processing work away from indexers, you'd use heavy forwarders.</P> Mon, 30 Oct 2017 21:31:12 GMT https://community.splunk.com/t5/Getting-Data-In/What-are-the-main-differences-between-the-Universal-forwarder/m-p/338381#M62460 somesoni2 2017-10-30T21:31:12Z