Deployment Architecture

What is the benefit of using a light forwarder?

connorsvilardo
Engager

I have a unix machine that is my main interface for splunk.

I would like to index some windows machines.

Why should I install a light forwarder on the windows machine as opposed to installing the windows app on the unix machine?

Tags (1)
1 Solution

Ron_Naken
Splunk Employee
Splunk Employee

The light forwarder on a Windows machine will allow you to easily capture all the metrics you could need, like Performance Metrics (CPU, Memory, Disk, Network), Windows Updates, Registry Changes, AD changes, etc. Installing the Windows app on the forwarder is also recommended, and it will ease configuration of capturing commonly-used data for Windows/AD monitoring.

On the Unix indexer, the Windows app is not necessary to view the data. However, you will want to install the Windows app on the UNIX indexer, because it will allow you to view the Windows data using reports and dashboards that have already been made for common uses, like resource consumption charts, windows update status, failed logins, etc.

View solution in original post

Ron_Naken
Splunk Employee
Splunk Employee

The light forwarder on a Windows machine will allow you to easily capture all the metrics you could need, like Performance Metrics (CPU, Memory, Disk, Network), Windows Updates, Registry Changes, AD changes, etc. Installing the Windows app on the forwarder is also recommended, and it will ease configuration of capturing commonly-used data for Windows/AD monitoring.

On the Unix indexer, the Windows app is not necessary to view the data. However, you will want to install the Windows app on the UNIX indexer, because it will allow you to view the Windows data using reports and dashboards that have already been made for common uses, like resource consumption charts, windows update status, failed logins, etc.

Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...