Deployment Architecture

What is the benefit of using a light forwarder?

connorsvilardo
Engager

I have a unix machine that is my main interface for splunk.

I would like to index some windows machines.

Why should I install a light forwarder on the windows machine as opposed to installing the windows app on the unix machine?

Tags (1)
1 Solution

Ron_Naken
Splunk Employee
Splunk Employee

The light forwarder on a Windows machine will allow you to easily capture all the metrics you could need, like Performance Metrics (CPU, Memory, Disk, Network), Windows Updates, Registry Changes, AD changes, etc. Installing the Windows app on the forwarder is also recommended, and it will ease configuration of capturing commonly-used data for Windows/AD monitoring.

On the Unix indexer, the Windows app is not necessary to view the data. However, you will want to install the Windows app on the UNIX indexer, because it will allow you to view the Windows data using reports and dashboards that have already been made for common uses, like resource consumption charts, windows update status, failed logins, etc.

View solution in original post

Ron_Naken
Splunk Employee
Splunk Employee

The light forwarder on a Windows machine will allow you to easily capture all the metrics you could need, like Performance Metrics (CPU, Memory, Disk, Network), Windows Updates, Registry Changes, AD changes, etc. Installing the Windows app on the forwarder is also recommended, and it will ease configuration of capturing commonly-used data for Windows/AD monitoring.

On the Unix indexer, the Windows app is not necessary to view the data. However, you will want to install the Windows app on the UNIX indexer, because it will allow you to view the Windows data using reports and dashboards that have already been made for common uses, like resource consumption charts, windows update status, failed logins, etc.

Get Updates on the Splunk Community!

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...