Getting Data In

Benefits of Using a Forwarder?

Path Finder

Could someone explain the benefits of using a forwarder?

The main benefits explained in the doc (data consolidation, load balancing, and data routing) are not related to the setup my team is planning as we only have one source directly pushing events to Splunk.

Corollary question: does using a heavy forwarder take more stress off the receiver compared to a light forwarder?

Tags (1)
0 Karma

Ultra Champion

The lovely book – "Big Data Analytics Using Splunk" says on page #286 -

"Whereas the data collected by forwarders contains the standard Splunk fields (host, source and source type), which makes for easy categorization, these fields might not be enough to catalog data. For example, when collecting Windows WMI events, you might want to separate hardware from software events, so that they can be analyzed by the appropriate technical people. "

So, the heavy forwarder has more capabilities to process the incoming data.



We use a forwarder to collect al out syslog data from the syslog server. We opted to keep the syslog server and use a UF to we could work on splunk, i.e. restart and not worry about loosing data during the restart. The UF will cache the data until it can send it to the indexer.

The HF can do some processing on the data then send it to the indexer. So yes it could help, I've never had a reason to do that. I'd suggest you look at the SOS and deployment apps to help monitor things.

The other reason I like not going directly to splunk is if there is an issue that affects splunk my logs still are in flat files on the server.

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...