what i think you're asking is if you set up an input via Splunk Web on the primary instance, and also send the same data to the primary instance via a forwarder on the smaller server, will you get duplicate data? i'd assume that yes, you would--you only need to do one or the other.
with respect to which way is better--in general, Splunk recommends using a forwarder rather than the remote polling option on Windows, for these reasons:
"For identical collecting of local Event Logs and flat files, a forwarder requires less CPU and performs basic pre-compression of the data in an effort to reduce network overhead. It is more memory intensive, however, mostly owing to the additional data source input options available.
If the forwarder is configured to run as the Local System user, the authentication requirements for the local machine are eliminated, as that account has full access to the local machine.
Remote polling over WMI is more CPU intensive on the target machine for the same set of data (either remote Event Logs or remote performance data), and is more network intensive overall. It requires that Splunk runs as a user with explicit access to these data sources."
(from
http://www.splunk.com/base/Documentation/latest/Data/ConsiderationsfordecidinghowtomonitorWindowsdata )
if your smaller server were running a non-Windows OS, you can make the same choice (forwarder or remote input), although my assumption is that it becomes less about performance concerns and more about ease of management. if you have just a few inputs, it's probably easier to set them up from the primary splunk instance, and not worry about installing anything on the other box at all. it depends on your preference and requirements.
... View more
