Agents
These are the thin and thick clients from Splunk that can be used to forward data to Splunk.
Splunk Universal Forwarder
Splunk Universal Forwarder is a light agent that is installed on a device that enables you with quite a bit of functionality to get data into a Splunk index. The name is pretty self-explanatory, as this agent is designed to simply forward data to a Splunk index. This is often the most common method to get data into Splunk.
Splunk Heavy Forwarder
This is a heavy agent. It is basically a full version of Splunk that is installed on a device in order to perform the same data-forwarding functionality as the Universal Forwarder, with the added benefit of being able to perform some more complex functions.
It is often used as a centralized point for data gathering of multiple systems, as well as a data router to collect, route, and scrub data appropriately before it hits an indexer. These are usually standalone machines within your Splunk infrastructure.
