Getting Data In
Highlighted

Should heavy forwarders have the same apps installed on them that are installed on the Splunk enterprise receiver?

Communicator

Hi. I am working on a Splunk deployment that involves a Splunk enterprise receiver at the data center and heavy forwarders at the branch offices. Do the heavy forwarders need to have the same apps installed on them as the Splunk receiver?

Thanks.

0 Karma
Highlighted

Re: Should heavy forwarders have the same apps installed on them that are installed on the Splunk enterprise receiver?

Motivator

This is not a straight yes/no question. It depends on what the apps are configured for. If they include transforms and filters, then possibly yes. The "receiver" as you call it does the grunt-work most of the time. But when you have a heavy forwarder in the mix, then presumably that is for a reason, and it is part-cooking the data stream it handles.

View solution in original post