1. In order to run DB connect you need to run it on a Heavy Forwarder, as it contains many component’s that are pre-requisites. Use the below link for more details https://docs.splunk.com/Documentation/DBX/3.16.0/DeployDBX/HowSplunkDBConnectworks 2. In short yes, Splunk has in built functions to be able to send data to different destinations, using the UF, so simple example, if you have Splunk on premise and Splunk in cloud, you can send to both if desired. Parsing the data, has performance gains if going via the HF, it will examine the data, and transform it, there are many sub parts to the pipeline process. In terms of the fast mode when you parse data before indexing, the extracted fields are available for use in searches, regardless of whether you're using fast mode or not, the fast mode is one of three modes, allows you to search for available data using a different criterion. See the three below links for more details: https://docs.splunk.com/Documentation/Splunk/9.0.4/Forwarding/Routeandfilterdatad https://docs.splunk.com/Documentation/Splunk/9.2.1/Deploy/Datapipeline https://docs.splunk.com/Documentation/SplunkCloud/9.1.2312/Search/Changethesearchmode 3. If you data source can only send API data to Splunk, then this is a good option (it’s basically agentless) and called the HTTP event collector. https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/UsetheHTTPEventCollector
... View more
