thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Advanced

Splunk Heavy Forwarder (HF)

A full Splunk Enterprise instance configured to parse, filter, route and forward data before indexing.

Definition

Heavy forwarders can mask data, drop unwanted events, route to different indexes or destinations and host modular inputs for API-based collection. They consume more resources than universal forwarders. They are commonly used as intermediate collection points.

Example

A heavy forwarder using props.conf and transforms.conf to drop debug events before forwarding.

Exam tip

Choose a heavy forwarder when data must be filtered or routed before reaching indexers.

Related terms