What are the main differences between the Universal forwarder and Heavy forwarder?

[test_qweqwe]

Can someone explain me in simply english the difference between there two forwards and where they are using?

[somesoni2 · Accepted solution]

Generally description from below link would answer your question.
http://docs.splunk.com/Documentation/Splunk/6.6.3/Forwarding/Typesofforwarders

If not, a universal forwarder only does the collection and forwarding of data (collects data and sends to other Splunk instance where it'll be processed). It doesn't do data processing (event parsing, timestamp extractions , routing, masking etc) with exception of structured data types such as json, Whereas a heavy forwarder, as name suggests, does collection, processing and forwarding. A heavy forwarder can also do local indexing if configured to do so. Detailed differences can be found here: http://docs.splunk.com/Documentation/Splunk/6.6.3/Forwarding/Typesofforwarders#Forwarder_comparison

In most use-cases of data forwarding, you would use Universal forwarder and leave data processing to intermediate heavy forwarders/indexers. In cases where you want to do local indexing OR keep the data processing work away from indexers, you'd use heavy forwarders.