Deployment Architecture

What is the benefit of using a light forwarder?

connorsvilardo
Engager

I have a unix machine that is my main interface for splunk.

I would like to index some windows machines.

Why should I install a light forwarder on the windows machine as opposed to installing the windows app on the unix machine?

Tags (1)
1 Solution

Ron_Naken
Splunk Employee
Splunk Employee

The light forwarder on a Windows machine will allow you to easily capture all the metrics you could need, like Performance Metrics (CPU, Memory, Disk, Network), Windows Updates, Registry Changes, AD changes, etc. Installing the Windows app on the forwarder is also recommended, and it will ease configuration of capturing commonly-used data for Windows/AD monitoring.

On the Unix indexer, the Windows app is not necessary to view the data. However, you will want to install the Windows app on the UNIX indexer, because it will allow you to view the Windows data using reports and dashboards that have already been made for common uses, like resource consumption charts, windows update status, failed logins, etc.

View solution in original post

Ron_Naken
Splunk Employee
Splunk Employee

The light forwarder on a Windows machine will allow you to easily capture all the metrics you could need, like Performance Metrics (CPU, Memory, Disk, Network), Windows Updates, Registry Changes, AD changes, etc. Installing the Windows app on the forwarder is also recommended, and it will ease configuration of capturing commonly-used data for Windows/AD monitoring.

On the Unix indexer, the Windows app is not necessary to view the data. However, you will want to install the Windows app on the UNIX indexer, because it will allow you to view the Windows data using reports and dashboards that have already been made for common uses, like resource consumption charts, windows update status, failed logins, etc.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...