https://community.splunk.com/t5/Getting-Data-In/Help-with-choice-of-forwarder/m-p/471257#M81012 <P>3 questions:</P> <P>Can I use directly syslog for everything enabling it to each machine, without getting use of universal forwarder or heavy? <BR /> What is the advantage to use directly it rather than install UF for instance?</P> <P>What is the difference between the heavy forwarder and an indexer for example?</P> <P>Then must I use the add-on with a universal forwarder or I can install it without to use it?<BR /> Would everything work the same? what do they used for is it like a dsm?</P> Tue, 29 Oct 2019 16:20:05 GMT dani9 2019-10-29T16:20:05Z https://community.splunk.com/t5/Getting-Data-In/Help-with-choice-of-forwarder/m-p/471257#M81012 <P>3 questions:</P> <P>Can I use directly syslog for everything enabling it to each machine, without getting use of universal forwarder or heavy? <BR /> What is the advantage to use directly it rather than install UF for instance?</P> <P>What is the difference between the heavy forwarder and an indexer for example?</P> <P>Then must I use the add-on with a universal forwarder or I can install it without to use it?<BR /> Would everything work the same? what do they used for is it like a dsm?</P> Tue, 29 Oct 2019 16:20:05 GMT https://community.splunk.com/t5/Getting-Data-In/Help-with-choice-of-forwarder/m-p/471257#M81012 dani9 2019-10-29T16:20:05Z https://community.splunk.com/t5/Getting-Data-In/Help-with-choice-of-forwarder/m-p/471258#M81013 <P>Sending syslog directly to Splunk risks losing data if the indexer restarts. Using a forwarder helps prevent data loss and also improves search performance by evenly distributing data across all indexers.</P> <P>The difference between a heavy forwarder and an indexer is the HF does not store (index) data. The HF forwards the data to indexers for storage.</P> <P>For a good description of the reasons to not send syslog directly to Splunk, see <A href="http://www.georgestarcher.com/splunk-success-with-syslog/">http://www.georgestarcher.com/splunk-success-with-syslog/</A>.</P> Wed, 30 Oct 2019 00:51:44 GMT https://community.splunk.com/t5/Getting-Data-In/Help-with-choice-of-forwarder/m-p/471258#M81013 richgalloway 2019-10-30T00:51:44Z https://community.splunk.com/t5/Getting-Data-In/Help-with-choice-of-forwarder/m-p/471259#M81014 <P>Hi dani9,<BR /> as @richgalloway said, using an Heavy Forwarder gives you more flexibility.<BR /> In addition, I suggest (if you can) to use two Heavy Forwarders with a Load Balancer to ingest syslogs: this permits to avoid Single Points of Failure and be sure to have all the syslogs without losing anyrhing.<BR /> As Load balancer you can also use a DNS configuration.</P> <P>Ciao.<BR /> Giuseppe</P> Wed, 30 Oct 2019 07:43:30 GMT https://community.splunk.com/t5/Getting-Data-In/Help-with-choice-of-forwarder/m-p/471259#M81014 gcusello 2019-10-30T07:43:30Z https://community.splunk.com/t5/Getting-Data-In/Help-with-choice-of-forwarder/m-p/471260#M81015 <P>thank for those.</P> <P>So do you also light dreams about Add-on that is must I install it for each source?<BR /> what's those for? </P> Wed, 30 Oct 2019 08:27:39 GMT https://community.splunk.com/t5/Getting-Data-In/Help-with-choice-of-forwarder/m-p/471260#M81015 dani9 2019-10-30T08:27:39Z