thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Intermediate

Splunk Universal Forwarder (UF)

A lightweight Splunk agent that collects data from hosts and sends it to indexers or heavy forwarders.

Definition

The Universal Forwarder monitors files, Windows event logs and scripted inputs, sending data with minimal processing over TCP 9997 by default. It does not parse data (except structured data with indexed extractions) and has no web interface. Deployment servers manage forwarder configurations at scale.

Example

Configuring inputs.conf on a UF to monitor /var/log/secure with sourcetype linux_secure.

Exam tip

UF = minimal, no parsing; heavy forwarder = full parsing and filtering. Default receiving port is 9997.

Related terms