Getting Data In

Which forwarder to use?

rahiparikh
Explorer

Hi,

I wish to tag basic information in source data before I send it to Indexer. I wish to tag the host, sourcetype and such similar basic information. What forwarder should I use?

( I tried to read the docs but it got me confused! 😞 )

Thanks!

0 Karma
1 Solution

IT_Bullgod
Splunk Employee
Splunk Employee

Based on the current version of Splunk, there are 3 types of Forwarder configuration:

The universal forwarder is a streamlined, dedicated version of Splunk that contains only the essential components needed to forward data to receivers.

A heavy forwarder is a full Splunk instance, with some features disabled to achieve a smaller footprint.

A light forwarder is also a full Splunk instance, with most features disabled to achieve as small a footprint as possible.

The lightweight forwarder type is typically used to support previous versions of Splunk, and likely should not be needed in new installations. Now you simply need to decide if you need a heavy or Universal forwarder, and that decision usually comes down to whether or not you need to filter or route data from the forwarder.

In your example above, tagging source and hostname are actually part of the Splunk metadata - these elements are typically attached to your event data by default. In this case, you can use the Universal Forwarder.

If you plan to route event data to multiple hosts, or if you want to limit (filter) the data from the Forwarder to the indexer, then you'll need a heavy forwarder.

View solution in original post

IT_Bullgod
Splunk Employee
Splunk Employee

Based on the current version of Splunk, there are 3 types of Forwarder configuration:

The universal forwarder is a streamlined, dedicated version of Splunk that contains only the essential components needed to forward data to receivers.

A heavy forwarder is a full Splunk instance, with some features disabled to achieve a smaller footprint.

A light forwarder is also a full Splunk instance, with most features disabled to achieve as small a footprint as possible.

The lightweight forwarder type is typically used to support previous versions of Splunk, and likely should not be needed in new installations. Now you simply need to decide if you need a heavy or Universal forwarder, and that decision usually comes down to whether or not you need to filter or route data from the forwarder.

In your example above, tagging source and hostname are actually part of the Splunk metadata - these elements are typically attached to your event data by default. In this case, you can use the Universal Forwarder.

If you plan to route event data to multiple hosts, or if you want to limit (filter) the data from the Forwarder to the indexer, then you'll need a heavy forwarder.

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...

Network to App: Observability Unlocked [May & June Series]

In today’s digital landscape, your environment is no longer confined to the data center. It spans complex ...

SPL2 Deep Dives, AppDynamics Integrations, SAML Made Simple and Much More on Splunk ...

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...