heavy forwarder

noun

A type of forwarder, a Splunk instance that forwards data to another Splunk server or a third-party system.

A heavy forwarder has a smaller footprint than a Splunk indexer but retains most of the capability, except that it lacks the ability to perform distributed searches. Much of its default functionality, such as Splunk Web, can be disabled to reduce the size of its footprint.

Unlike other types of forwarders, a heavy forwarder parses data before forwarding it and can route data based on criteria such as source or type of event. It can also index data locally while forwarding the data to another Splunk indexer.

Besides the heavy forwarder, there are two other types of forwarders:

Starting with 4.2, the universal forwarder is a streamlined, dedicated version of Splunk that contains only the essential components needed to forward data.
A light forwarder is, like the heavy forwarder, a full Splunk instance, with most features disabled to achieve as small a footprint as possible. Beginning with 4.2, the universal forwarder supersedes the light forwarder for nearly all purposes.

In nearly all respects, the universal forwarder represents the best tool for forwarding data to indexers. Its main limitation is that it forwards only unparsed data. Therefore, you cannot use it to route data based on event contents. For that, you must use a heavy forwarder.