Help with choice of forwarder

[dani9]

3 questions:

Can I use directly syslog for everything enabling it to each machine, without getting use of universal forwarder or heavy?
What is the advantage to use directly it rather than install UF for instance?

What is the difference between the heavy forwarder and an indexer for example?

Then must I use the add-on with a universal forwarder or I can install it without to use it?
Would everything work the same? what do they used for is it like a dsm?

[dani9]

thank for those.

So do you also light dreams about Add-on that is must I install it for each source?
what's those for?

[richgalloway]

Sending syslog directly to Splunk risks losing data if the indexer restarts. Using a forwarder helps prevent data loss and also improves search performance by evenly distributing data across all indexers.

The difference between a heavy forwarder and an indexer is the HF does not store (index) data. The HF forwards the data to indexers for storage.

For a good description of the reasons to not send syslog directly to Splunk, see http://www.georgestarcher.com/splunk-success-with-syslog/.

[gcusello]

Hi dani9,
as @richgalloway said, using an Heavy Forwarder gives you more flexibility.
In addition, I suggest (if you can) to use two Heavy Forwarders with a Load Balancer to ingest syslogs: this permits to avoid Single Points of Failure and be sure to have all the syslogs without losing anyrhing.
As Load balancer you can also use a DNS configuration.

Ciao.
Giuseppe