Should heavy forwarders have the same apps installed on them that are installed on the Splunk enterprise receiver?

[Bill_B]

Hi. I am working on a Splunk deployment that involves a Splunk enterprise receiver at the data center and heavy forwarders at the branch offices. Do the heavy forwarders need to have the same apps installed on them as the Splunk receiver?

Thanks.

[grijhwani · Accepted solution]

This is not a straight yes/no question. It depends on what the apps are configured for. If they include transforms and filters, then possibly yes. The "receiver" as you call it does the grunt-work most of the time. But when you have a heavy forwarder in the mix, then presumably that is for a reason, and it is part-cooking the data stream it handles.