Benefits of Using a Forwarder?

[ConnorG]

Could someone explain the benefits of using a forwarder?

The main benefits explained in the doc (data consolidation, load balancing, and data routing) are not related to the setup my team is planning as we only have one source directly pushing events to Splunk.

Corollary question: does using a heavy forwarder take more stress off the receiver compared to a light forwarder?

[ddrillic]

The lovely book – "Big Data Analytics Using Splunk" says on page #286 -

"Whereas the data collected by forwarders contains the standard Splunk fields (host, source and source type), which makes for easy categorization, these fields might not be enough to catalog data. For example, when collecting Windows WMI events, you might want to separate hardware from software events, so that they can be analyzed by the appropriate technical people. "

So, the heavy forwarder has more capabilities to process the incoming data.

Regards,
Dan

[thomrs]

We use a forwarder to collect al out syslog data from the syslog server. We opted to keep the syslog server and use a UF to we could work on splunk, i.e. restart and not worry about loosing data during the restart. The UF will cache the data until it can send it to the indexer.

The HF can do some processing on the data then send it to the indexer. So yes it could help, I've never had a reason to do that. I'd suggest you look at the SOS and deployment apps to help monitor things.

https://apps.splunk.com/app/748/
https://apps.splunk.com/app/1294/

The other reason I like not going directly to splunk is if there is an issue that affects splunk my logs still are in flat files on the server.