Agent vrs Forwarder?

[rayjsplunk]

Is a Splunk Agent the same as a Splunk Forwarder?

Thanks,

Ray

[Rayj00]

Thanks for clearing that up!

[dwaddle]

You're welcome - please click the green checkbox next to the answer to "accept" it and mark this question as resolved.

[dwaddle]

Basically yes. Splunk does not refer to anything as an "agent" - that is terminology borrowed from other systems.

But, similar to an agent, a Splunk forwarder installs on many "client" systems (who may be "servers" themselves [web,ftp,mysql] , but they are not "servers" in the Splunk application sense).

Until 4.2, the same install package is used no matter what role a machine is playing (forwarder, indexer, search head). With 4.2, and the Universal forwarder, the packaging is much more like the traditional "server install" versus "agent install"