topic Re: Heavy Forwarder Configuration Query in Splunk Enterprise Security

Heavy Forwarder Configuration Query

spodda01da — Mon, 18 Nov 2019 06:17:04 GMT

Hi All,

I have inherited Splunk Enterprise in my company which includes 3 Indexers, 2 Search Head and each Deployment & Licensing Master and Cluster Master.

Now in order to receive events from more than 250 servers, Do I need to setup a separate Heavy Forwarder (server) or can we use the above setup/configuration and use one of them as heavy forwarder.

Thanks,

Re: Heavy Forwarder Configuration Query

sanjeev543 — Mon, 18 Nov 2019 07:05:04 GMT

Hi,

Using HF in your current setup depends, how much data you are indexing per day? your budget
HF will reduce performing impact on Indexers , it helps you to parse,filter, can index locally and with many other benefits.
Please refer the documentation

https://docs.splunk.com/Documentation/Splunk/8.0.0/Forwarding/Typesofforwarders

If you need all these benefits then you should consider having HFs in your environment

Re: Heavy Forwarder Configuration Query

gcusello — Mon, 18 Nov 2019 08:07:07 GMT

Hi @spodda01da,
Heavy Forwarders are useful in these situations:

if you have to ingest syslogs,
if you have a part of your Universal Forwarders in a separate network and you don't want to open all the firewall routes between targets and Indexers,
if you have a great parsing job and you want to reduce load on Indexers.

For my experience, only the first two options really justify the use of an Heavy Forwarder, for the third, I prefer to add more resources to Indexers or ad an Indexer then add an Heavy Forwearder.

In addition remember that, when you decide to use an Heavy Forwarder, you have always to duplicate it to avoid a Single Points of Failure and you have to carefully configure them to avoid bottlenecks.

Ciao.
Giuseppe