Automatically Send Data for Indexing
Forwarders provide reliable, secure data collection from various sources and deliver the data to Splunk Enterprise or Splunk Cloud for indexing and analysis. There are several types of forwarders, but the most common is the universal forwarder, a small footprint agent, installed directly on an endpoint. Forwarders automatically send file-based data of any sort to the Splunk indexer. In most cases these are log events of some sort, but the files can contain any data in any format.
Universal forwarders are centrally managed, require no configuration and are transparent to endpoint operations. Large Splunk customers deploy thousands of universal forwarders to gather data from servers, applications, employee endpoints and any Windows or Unix-based system regardless of location.
- Forward data from remote systems securely in real time
- Have minimal resource overhead and impact on endpoint performance
- Support thousands of machine data formats
- Provide many features such as SSL, compression and buffering
Reliable, Secure Data Collection
Forwarders communicate using TCP sockets, so message delivery is guaranteed. Forwarders can detect a network outage and automatically failover to another target indexer or buffer events locally until the target indexer is available again. Indexers can be configured to provide index-side acknowledgement that data was received. Communication between a forwarder and indexer can be configured to use SSL authentication and encryption.
Centralized Management and Monitoring
Centralized forwarder management simplifies the administration of hundreds or thousands of forwarders in your environment. Forwarder management includes a visual interface to deploy thousands of configurations, monitor the status of rollouts and track down errors. Forwarders can also be remotely managed and configured via the Splunk REST API. The Distributed Management Console provides powerful forwarder monitoring in a visual interface that includes forwarder-indexer mapping.
- Rapidly deploy forwarders with an existing deployment solution, such as SCCM, Chef or Puppet
- Forwarders support virtually any machine data format and run on most modern operating systems
- No database schemas, parsers or connectors to design, deploy or purchase
- Forwarders can load balance data between multiple indexers, route data in raw format to integrate with third-party systems, clone data to allow for high availability and conditionally route data to different locations to support multitenant environments.