Splunk Core Certified Advanced Power User — Question 29

Which Splunk forwarder type allows parsing of data before forwarding to an indexer?

Answer options

• A. Universal forwarder
• B. Parsing forwarder
• C. Heavy forwarder
• D. Advanced forwarder

Correct answer: C

Explanation

The Heavy forwarder is designed to perform data parsing and indexing before forwarding data to an indexer, making it suitable for processing data in advance. In contrast, the Universal forwarder only transmits raw data without any parsing, and the other options do not exist in the context of Splunk forwarders.