Splunk Enterprise Certified Admin Practice Test

Which type of forwarder does not parse or search data?

1. Universal

2. Heavy

3. Light

4. SNMP

The correct answer is: Universal

The type of forwarder that does not parse or search data is the Universal Forwarder. It is specifically designed to securely forward raw data from the source to indexers and does not perform any data processing or searching on its own. This makes it lightweight and efficient, as it only collects and transmits data without adding any additional resource overhead for parsing or interpreting the data. In contrast, a Heavy Forwarder does parse data and can perform indexing and searching before the data is forwarded. It has the capacity to handle complex data inputs and can apply transformations or modify the data as part of the forwarding process. The Light Forwarder, which does not exist as a specific entity in the Splunk architecture, might refer to a forwarding function that is less involved in processing than a Heavy Forwarder, but it is not a recognized term in Splunk vocabulary. Similarly, SNMP (Simple Network Management Protocol) is not a type of forwarder but a protocol used for network management and cannot be classified along the same lines as the Universal and Heavy Forwarders. The Universal Forwarder maintains its role as the simplest form of data collection, free from the parsing and searching processing, making it beneficial for environments that require optimized performance without data overhead.