Agents

These are the thin and thick clients from Splunk that can be used to forward data to Splunk.

Splunk Universal Forwarder

Splunk Universal Forwarder is a light agent that is installed on a device that enables you with quite a bit of functionality to get data into a Splunk index. The name is pretty self-explanatory, as this agent is designed to simply forward data to a Splunk index. This is often the most common method to get data into Splunk.

Splunk Heavy Forwarder

This is a heavy agent. It is basically a full version of Splunk that is installed on a device in order to perform the same data-forwarding functionality as the Universal Forwarder, with the added benefit of being able to perform some more complex functions.

It is often used as a centralized point for data gathering of multiple systems, as well as a data router to collect, route, and scrub data appropriately before it hits an indexer. These are usually standalone machines within your Splunk infrastructure.

Search Head Forwarder

If you have limited ability to create an infrastructure, or you have security limitations within your environment, you can also use your Search Head as a Heavy Forwarder as it has all of the essential functionality of a Heavy Forwarder. This can be resource intensive depending on how many data inputs you are pumping into your indexers, so mind the resource utilization if you use this method.