Splunk Enterprise Security

Heavy Forwarder Configuration Query


Hi All,

I have inherited Splunk Enterprise in my company which includes 3 Indexers, 2 Search Head and each Deployment & Licensing Master and Cluster Master.

Now in order to receive events from more than 250 servers, Do I need to setup a separate Heavy Forwarder (server) or can we use the above setup/configuration and use one of them as heavy forwarder.


0 Karma


Hi @spodda01da,
Heavy Forwarders are useful in these situations:

  • if you have to ingest syslogs,
  • if you have a part of your Universal Forwarders in a separate network and you don't want to open all the firewall routes between targets and Indexers,
  • if you have a great parsing job and you want to reduce load on Indexers.

For my experience, only the first two options really justify the use of an Heavy Forwarder, for the third, I prefer to add more resources to Indexers or ad an Indexer then add an Heavy Forwearder.

In addition remember that, when you decide to use an Heavy Forwarder, you have always to duplicate it to avoid a Single Points of Failure and you have to carefully configure them to avoid bottlenecks.


0 Karma



Using HF in your current setup depends, how much data you are indexing per day? your budget
HF will reduce performing impact on Indexers , it helps you to parse,filter, can index locally and with many other benefits.
Please refer the documentation


If you need all these benefits then you should consider having HFs in your environment

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!