Getting Data In

Benefits of Using a Forwarder?

Path Finder

Could someone explain the benefits of using a forwarder?

The main benefits explained in the doc (data consolidation, load balancing, and data routing) are not related to the setup my team is planning as we only have one source directly pushing events to Splunk.

Corollary question: does using a heavy forwarder take more stress off the receiver compared to a light forwarder?

Tags (1)
0 Karma

Ultra Champion

The lovely book – "Big Data Analytics Using Splunk" says on page #286 -

"Whereas the data collected by forwarders contains the standard Splunk fields (host, source and source type), which makes for easy categorization, these fields might not be enough to catalog data. For example, when collecting Windows WMI events, you might want to separate hardware from software events, so that they can be analyzed by the appropriate technical people. "

So, the heavy forwarder has more capabilities to process the incoming data.



We use a forwarder to collect al out syslog data from the syslog server. We opted to keep the syslog server and use a UF to we could work on splunk, i.e. restart and not worry about loosing data during the restart. The UF will cache the data until it can send it to the indexer.

The HF can do some processing on the data then send it to the indexer. So yes it could help, I've never had a reason to do that. I'd suggest you look at the SOS and deployment apps to help monitor things.

The other reason I like not going directly to splunk is if there is an issue that affects splunk my logs still are in flat files on the server.

Get Updates on the Splunk Community!

Don't wait! Accept the Mission Possible: Splunk Adoption Challenge Now and Win ...

Attention everyone! We have exciting news to share! We are recruiting new members for the Mission Possible: ...

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...