Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: Splunk Heavy Forwarder
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
Will Splunk support heavy forwarder in future or it's going to be decommitted?
I'm asking because there are only links to Splunk and SplunkUniversalForwarder in download section.
Thanks,
Vladimir
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Splunk UF is way lighter and the only job it is (almost!) doing is forwarding the collected data the Splunk instance. There is no processing here. That's why it is less resource demanding.
Moreover, on the security point of view, the UF doesn't have a web UI and therefore you cannot unable it. This can be important in some cases.
Hope it helps.
Regards,
OL
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks very much to all!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Splunk UF is way lighter and the only job it is (almost!) doing is forwarding the collected data the Splunk instance. There is no processing here. That's why it is less resource demanding.
Moreover, on the security point of view, the UF doesn't have a web UI and therefore you cannot unable it. This can be important in some cases.
Hope it helps.
Regards,
OL
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
So, in this case there is no advantages in using Splunk+SplunkUniversalForwarder instead of Splunk with configuring forwarding, right?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Vladimir,
The heavy forwarder is just the full install of Splunk. There is no separate download for it.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
May 2026 Splunk Expert Sessions: Security & Observability
Network to App: Observability Unlocked [May & June Series]
SPL2 Deep Dives, AppDynamics Integrations, SAML Made Simple and Much More on Splunk ...
