Splunk Enterprise Security

Heavy Forwarder Configuration Query

spodda01da
Path Finder

Hi All,

I have inherited Splunk Enterprise in my company which includes 3 Indexers, 2 Search Head and each Deployment & Licensing Master and Cluster Master.

Now in order to receive events from more than 250 servers, Do I need to setup a separate Heavy Forwarder (server) or can we use the above setup/configuration and use one of them as heavy forwarder.

Thanks,

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @spodda01da,
Heavy Forwarders are useful in these situations:

  • if you have to ingest syslogs,
  • if you have a part of your Universal Forwarders in a separate network and you don't want to open all the firewall routes between targets and Indexers,
  • if you have a great parsing job and you want to reduce load on Indexers.

For my experience, only the first two options really justify the use of an Heavy Forwarder, for the third, I prefer to add more resources to Indexers or ad an Indexer then add an Heavy Forwearder.

In addition remember that, when you decide to use an Heavy Forwarder, you have always to duplicate it to avoid a Single Points of Failure and you have to carefully configure them to avoid bottlenecks.

Ciao.
Giuseppe

0 Karma

sanjeev543
Communicator

Hi,

Using HF in your current setup depends, how much data you are indexing per day? your budget
HF will reduce performing impact on Indexers , it helps you to parse,filter, can index locally and with many other benefits.
Please refer the documentation

https://docs.splunk.com/Documentation/Splunk/8.0.0/Forwarding/Typesofforwarders

If you need all these benefits then you should consider having HFs in your environment

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.


Introducing Unified TDIR with the New Enterprise Security 8.2

Read the blog

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...