Duration: 2 months
Hours: 90 Hours
75 Days Real-Time Lab Access
What is Splunk Forwarder?
Forwarders: Forwarders are used to collect the data from various end devices like network devices, Security devices, servers, application and many more and then send the data to indexer to further to heavy forwarders There are 2 types of forwarders
What is Splunk Universal Forwarder?
Universal forwarder is a light weight client can be install on the end servers like Windows, Linux, Mac etc. which collects the logs locally and apply meta data fields like source, host and source type and send it to Heavy Forwarders for further process or directly to Indexer, then main advantage of installing Universal forwarders is that I can collect full logs on the host like memory utilization logs, registry logs, CPU logs and all. Universal forwarder do not parse the events it send the events to heavy forwarder for parsing or to directly Indexer for further parsing and searching the data.
What is Splunk Heavy Forwarder?
2.It is a full instance of Splunk enterprise we, configure the receiving and forwarding on it, that means it can collect the logs directly from end devices as well as from Universal forwarders and from any other heavy forwarders, Once the Heavy Forwarder collect the logs it parse the logs and send it to Indexer, without heavy forwarder also we can directly receive the logs on the indexer from end devices and universal forwarders but heavy forwarder reduces the one level of work of Indexer which is parsing, if we introduce heavy forwarder then indexer will not have to do the parsing it can receive the logs from heavy forwarders compress the logs and write the logs on the indexer.
What is Splunk Indexer?
Indexer is the core component of Splunk architecture once it receives the logs from forwarders or end devices it parses the logs compress the logs and write the logs on the disk which is called and indexing, Indexer can keep the logs for long time for compliance, auditing and forensics perspective, Storage where Splunk stores the logs called and Bucket.