Splunk Enterprise Certified Architect — Question 38

When should a Universal Forwarder be used instead of a Heavy Forwarder?

Answer options

• A. When most of the data requires masking.
• B. When data comes directly from a database server.
• C. When there is a high-velocity data source.
• D. When a modular input is needed.

Correct answer: C

Explanation

A Universal Forwarder is designed for high-velocity data sources because it is lightweight and optimized for forwarding data quickly. In contrast, a Heavy Forwarder is more resource-intensive and is not necessary for high-velocity scenarios. The other options pertain to specific use cases where a Heavy Forwarder might be more appropriate, but they do not align with the need for high data velocity.