Heavy Forwarder management
A Heavy Forwarder is usually used in instances where an administrator needs some more functionality, such as event routing (errors go to the error index, and info messages go to the info index), data routing, or collecting API information to be sent to the indexers. Heavy Forwarders can also be used for advanced, detailed filtering of data to reduce indexing volume.
Indexers are the heart of a Splunk system, and you can think of them as a big database. They will almost always be the beefiest of your machines, because they are doing the lion's share of the heavy lifting.
This is a diagram depicting a typical Splunk deployment:
Within a Splunk deployment a new admin often asks the question: When would you ever need a Heavy Forwarder?
The answer to this question is complicated; however, I'll give a single use case where it is good to use a Heavy Forwarder.
A Heavy Forwarder should be deployed in circumstances in which data needs to be parsed, re-routed,...
