Splunk Core Certified User — Question 112

Log filtering/parsing can be done from _____________.

Answer options

• A. Index Forwarders (IF)
• B. Universal Forwarders (UF)
• C. Super Forwarder (SF)
• D. Heavy Forwarders (HF)

Correct answer: D

Explanation

Heavy Forwarders (HF) are capable of performing log filtering and parsing due to their advanced processing capabilities before sending data to the indexers. In contrast, Universal Forwarders (UF) focus on data collection and do not perform such tasks, while Index Forwarders (IF) are primarily for indexing and Super Forwarder (SF) is not a recognized type of forwarder.