Do services typically running on a heavy forwarder?

[Quantum]

I have two machines one looks like it's a heavy forwarder, I can browse into the GUI of the first Splunk server but cannot browse into the GUI  on the heavy forwarder. is this normal?

do you usually have a GUI access on the heavy forwarder??. is there a service that needs to be running to allow it to serve web traffic.?

[richgalloway]

It's common for HFs to have the GUI enabled, but not required.  

The GUI is enabled or disabled by the startwebserver setting in web.conf.  It's also possible the default port of 8000 was changed to something by the httpport setting in the same file.  As always, a firewall could be blocking your connection to one HF.

[isoutamo]

As @richgalloway said it's normal that there is no GUI unless HF runs some TAs which needs/are easier to configure with GUI like TA-AWS, VMWare, DBX. All other cases it's better to disable GUI on all Splunk servers which don't need those. This is based on Security best practices.