Splunk Core Certified Advanced Power User — Question 126

Which forwarder is recommended by Splunk to use in a production environment?

Answer options

• A. Heavy forwarder
• B. SSL forwarder
• C. Lightweight forwarder
• D. Universal forwarder

Correct answer: D

Explanation

The Universal forwarder is the recommended choice by Splunk for production environments due to its lightweight nature and efficiency in data collection and forwarding. The Heavy forwarder, while powerful, is more resource-intensive and not ideal for all production scenarios. SSL forwarder and Lightweight forwarder are not standard terms recognized in the context of Splunk forwarders.