What is the difference between Splunk Enterprise and Universal Forwarder?

[bjyoti]

Hi All,

I am a newbie to splunk. I have gone through a number of video tutorials on the net.
Hi All,

I would like to know what is the difference between splunk enterprise and splunk universal forwarder.

what is the difference between the functionalities ? What is the recommended splunk?

Thanks

[neelamssantosh]

Perfect question cocoon..

As per my knowledge, initially it was designed in perl for sys admin(UNIX guys)2005, later using python UI was developed in 2008 and now they using JSON for better UI and results.

With Enterprise, you can search for logs using splunk CherryPy web browser UI where one can search the logs ,customize the Dashboards are Configuration,etc.where you can Enjoy the beauty of Splunk.

with Forwarder, we can collect the logs and send to respective Search Head or Indexer to index the data.It doesn't have any UI as of now.

ALL THE BEST

[strive · Accepted solution]

Read these

http://www.splunk.com/view/SP-CAAAE8W
http://docs.splunk.com/Documentation/Splunk/6.1.2/Admin/TypesofSplunklicenses

The splunk universal forwarder has the license enabled/applied automatically; no additional steps are required post-installation.
With Splunk universal forwarder you can only forward data, parsing and indexing is not possible.

[bjyoti]

Thanks Jeff 🙂

[Jeff_Lightly_Sp]

In simple, broad terms, install Enterprise on the server that will retain and index the data and do your searches from there. Install the universal forwarder on any server you wish to forward data to the Enterprise server previously mentioned. The docs that Strive mentioned will help too.

[bjyoti]

What use case they support?In what case the splunk enterprise and universal forwarder should be used ?

[bjyoti]

what should I install ??