Stolen from upcoming 4.1 docs, see those as soon as they are available:
A regular forwarder, also referred to as just a “forwarder,” has a smaller footprint than a Splunk server but retains most of the capability, except that it lacks the ability to do distributed searches. Much of its default functionality, such as Splunk Web, can be disabled, if necessary, to further reduce the size of its footprint. A forwarder parses data before forwarding it and can route data based on criteria such as source or type of event.
A light forwarder has a small footprint with limited functionality. Its size makes it ideal for forwarding data from workstations or non-Splunk production servers to a Splunk server for consolidation. It forwards only unparsed data and, therefore, cannot perform content-based routing. In addition, it does not include Splunk Web and its throughput is limited to 256kbs.
For detailed information on the capabilities of regular and light forwarders, see More about forwarders in this manual.
Both types of forwarders can perform automatic load balancing, with the regular forwarder also offering round-robin load balancing. Forwarders represent a much more robust solution for data forwarding than raw network feeds, with their capabilities for:
* Tagging of metadata (source, sourcetype, and host)
* Configurable buffering
* Data compression
* SSL security
* Use of any available network ports
