Heavy Forwarder Instance

[blkscorpio]

How Do I get the instance for heavy forwader for my vm box for set up. Is the UF instance differ from HF instance?

[PickleRick]

OK. Splunk terminology can be a bit confusing for newcomers 🙂

So let's straighten that a bit.

There are two separate installation packages that you can download:

- Universal Forwarder

- "full" Splunk Enterprise installer.

So Universal Forwarder is a relatively small instance with limited functionality meant only to be used for getting data using some subset of input types and forward the data downstream. It cannot do local indexing or searching, it doesn't have some other functionalities (like syslog forwarding).

Everything else you install from the Splunk Enterprise installer and you end up with a Splunk Enterprise server which can have one or more roles:

- indexer

- search head

- cluster manager

- license manager

- search head cluster deployer

- deployment server

- heavy forwarder

(you can also install an "all-in-one" instance performing both indexer and search head duties).

Heavy Forwarder is basically a Splunk Enterprise instance that does not perform local indexing - it doesn't store data it receives either from local inputs or from other forwarders locally but processes the events and forwards them to outputs (either another layer of forwarders or indexers).

So "forwarder" as a general term is a component which gets the data somehow and forwards it - it can be an UF or HF depending on which software package is used to install the server.

[gcusello]

Hi @blkscorpio,

why are you speaking of UF?

an HF has all the UF's features, so you don't need another instance on the same machine.

You can setup your HF to forward logs to Indexers in [Settings > Faowarding and Receiving > Forwarding].

Ciao.

Giuseppe

[blkscorpio]

Sorry I am just starting to learn Splunk and I am a bit confused.. So my question is does Universal Forwarder and Heavy Forwarder has  separate "Instances" on the Splunk web? I have 

[isoutamo]

Here is some free eLearnigs which covers basic Splunk stuff. https://education.splunk.com/Saba/Web_spf/NA10P2PRD105/app/shared;spf-url=common%2Fsearchresults%2Fx...
r. Ismo

[PickleRick]

UF does not have web interface.

Every other component, based on the full Splunk Enterprise package can have its own webui. But whether this webui will be on depends on your particular needs and architecture.

Indexers are typically run headless (without web interface). Search-heads are typically run with web interface (there are very rare cases when the search-head can be run headless but these are really border cases).

Deployment Server can be run with or without webui depending on how you're going to manage it.

HF can be run with or without webui (the core functionality - receiving and forwarding data - can be run without webui perfectly well but some apps need webui to initially configure them).

So it's a bit complicated 🙂

[gcusello]

Hi @blkscorpio ,

I think that you should read something about Splunk architecture.

Anyway, Spunk UF and HF are different packages: UF is a thin agent to install to ingest logs, instead HF is a Full Splunk instance (with a different package) where are used only the ingestion and forwardring features.

The HF has also all the UF's features and many other things.

UF hasn't a web interface, only HF has a web interface.

Start from Fundamentals I training to have the first introduction to Splunk.

Ciao.

Giuseppe