Splunk Core Certified Advanced Power User — Question 1

Which Splunk component requires a Forwarder license?

Answer options

• A. Search head
• B. Heavy forwarder
• C. Heaviest forwarder
• D. Universal forwarder

Correct answer: B

Explanation

The Heavy forwarder is the only Splunk component that necessitates a Forwarder license because it can perform data parsing and transformation. The Search head, Heaviest forwarder, and Universal forwarder do not require this specific license; the Universal forwarder, for instance, is designed for lightweight data forwarding without additional processing capabilities.