What is Splunk universal forwarder used for?

The Splunk universal forwarder is a free, dedicated version of Splunk Enterprise that contains only the essential components needed to forward data. TechSelect uses the universal forwarder to gather data from a variety of inputs and forward your machine data to Splunk indexers.Click to see full answer. Consequently, what is the use of Splunk forwarder?Universal Forwarders provide reliable, secure data collection from remote sources and forward that data into Splunk (Enterprise, Light, Cloud or Hunk) for indexing and consolidation. They can scale to tens of thousands of remote systems, collecting terabytes of data with minimal impact on performance.Furthermore, what is a splunk heavy forwarder? A type of forwarder, which is a Splunk Enterprise instance that sends data to another Splunk Enterprise instance or to a third-party system. A heavy forwarder has a smaller footprint than a Splunk Enterprise indexer but retains most of the capabilities of an indexer. Subsequently, question is, how does Splunk universal forwarder work? The universal forwarder collects data from a data source or another forwarder and sends it to a forwarder or a Splunk deployment. With a universal forwarder, you can send data to Splunk Enterprise, Splunk Light, or Splunk Cloud. It also replaces the Splunk Enterprise light forwarder.What is the difference between universal forwarder and heavy forwarder?A Universal Forwarder has no capability to parse data some metadata stamping on the events. A Heavy Forwarder is a full Splunk Instance with all the capabilities of Splunk Enterprise. You can simultaneously use a Heavy Forwarder to send data (just like a Universal Forwarder does) and also parse and Index data.