"This manual discusses the universal forwarder and how to plan, download, install, and configure it. There are two other types of forwarders. To learn about heavy and light forwarders and how they forward data, see About forwarding and receiving data in the Forwarding Data Manual.
To achieve higher performance and a lighter resource footprint, the universal forwarder has a subset of the functionality provided by a full Splunk platform deployment, specifically:
Cannot search or index data.
Cannot send alerts.
Does not parse incoming data, except in certain cases, such as structured data or some forms of Windows data.
Cannot send data to syslog servers as it has no syslog pipeline.
Does not include a version of Python."