Getting Data In

Help with choice of forwarder


3 questions:

Can I use directly syslog for everything enabling it to each machine, without getting use of universal forwarder or heavy?
What is the advantage to use directly it rather than install UF for instance?

What is the difference between the heavy forwarder and an indexer for example?

Then must I use the add-on with a universal forwarder or I can install it without to use it?
Would everything work the same? what do they used for is it like a dsm?

0 Karma


thank for those.

So do you also light dreams about Add-on that is must I install it for each source?
what's those for?

0 Karma


Sending syslog directly to Splunk risks losing data if the indexer restarts. Using a forwarder helps prevent data loss and also improves search performance by evenly distributing data across all indexers.

The difference between a heavy forwarder and an indexer is the HF does not store (index) data. The HF forwards the data to indexers for storage.

For a good description of the reasons to not send syslog directly to Splunk, see

If this reply helps you, Karma would be appreciated.
0 Karma


Hi dani9,
as @richgalloway said, using an Heavy Forwarder gives you more flexibility.
In addition, I suggest (if you can) to use two Heavy Forwarders with a Load Balancer to ingest syslogs: this permits to avoid Single Points of Failure and be sure to have all the syslogs without losing anyrhing.
As Load balancer you can also use a DNS configuration.


0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...