In Splunk data ingestion, which statement correctly differentiates a Universal Forwarder from a Heavy Forwarder?

• A. A Heavy Forwarder is lighter than a Universal Forwarder and handles only local storage.
• B. A Universal Forwarder is lightweight and forwards raw data; a Heavy Forwarder can parse, index, route data and run apps.
• C. Both perform exactly the same tasks; the difference is purely administrative.
• D. A Universal Forwarder can parse and index data; a Heavy Forwarder only forwards raw data.

Answer: (B)

In Splunk data ingestion, the key distinction is what processing happens at the forwarder. A Universal Forwarder is lightweight and designed solely to collect data from sources and forward raw data to Splunk components; it does not parse or index. A Heavy Forwarder is a full Splunk instance that can parse, index, and route data, and it can also run apps, enabling on-site processing before data reaches indexers. This is why the statement describing the Universal Forwarder as lightweight and forwarding raw data, and the Heavy Forwarder as able to parse, index, route data and run apps, is the correct one.

The other ideas don’t fit: a Heavy Forwarder isn’t lighter or limited to local storage; it’s the more capable, heavier option. Both forwarders don’t perform exactly the same tasks—parsing and indexing are distinct steps handled by the Heavy Forwarder. And the Universal Forwarder does not parse or index data; those functions belong to the Heavy Forwarder.