Getting Data In

What is the difference between a lightforwarder and a regular forwarder?

Splunk Employee
Splunk Employee

Apart from the fact that a lightforwarder does not have a web UI, what are the main differences between the 2 apps?

0 Karma
1 Solution

Splunk Employee
Splunk Employee

The main difference between a regular forwarder and a light forwarder is that the light forwarder doesn't do any parsing of data before sending it to the indexer.

A regular forwarder will do all of the line-breaking, event filtering and field extractions - and any other index-time operations you have deifined, before sending the data over to the indexer.

A LightForwarder will just assign the host, source, sourcetype and index values to a data packet, and then send it over to the indexer, which will then take care of all the index-time operations.

View solution in original post

Splunk Employee
Splunk Employee

Stolen from upcoming 4.1 docs, see those as soon as they are available:

A regular forwarder, also referred to as just a “forwarder,” has a smaller footprint than a Splunk server but retains most of the capability, except that it lacks the ability to do distributed searches. Much of its default functionality, such as Splunk Web, can be disabled, if necessary, to further reduce the size of its footprint. A forwarder parses data before forwarding it and can route data based on criteria such as source or type of event.

A light forwarder has a small footprint with limited functionality. Its size makes it ideal for forwarding data from workstations or non-Splunk production servers to a Splunk server for consolidation. It forwards only unparsed data and, therefore, cannot perform content-based routing. In addition, it does not include Splunk Web and its throughput is limited to 256kbs.

For detailed information on the capabilities of regular and light forwarders, see More about forwarders in this manual.

Both types of forwarders can perform automatic load balancing, with the regular forwarder also offering round-robin load balancing. Forwarders represent a much more robust solution for data forwarding than raw network feeds, with their capabilities for:

* Tagging of metadata (source, sourcetype, and host)
* Configurable buffering
* Data compression
* SSL security
* Use of any available network ports 
0 Karma

Splunk Employee
Splunk Employee

The main difference between a regular forwarder and a light forwarder is that the light forwarder doesn't do any parsing of data before sending it to the indexer.

A regular forwarder will do all of the line-breaking, event filtering and field extractions - and any other index-time operations you have deifined, before sending the data over to the indexer.

A LightForwarder will just assign the host, source, sourcetype and index values to a data packet, and then send it over to the indexer, which will then take care of all the index-time operations.

View solution in original post