Which of the following is true when using Intermediate Forwarders?

Which of the following is true when using Intermediate Forwarders?
A . Intermediate Forwarders may be a mix of Universal and Heavy Forwarders.
B . All Intermediate Forwarders must be Heavy Forwarders.
C . Intermediate Forwarders may be Universal Forwarders or Heavy Forwarders, but may not be mixed.
D . All Intermediate Forwarders must be Universal Forwarders.

View Answer

Answer: B

Explanation:

Intermediate Forwarders are special types of forwarders that sit between Universal Forwarders and indexers to perform additional processing tasks such as routing, filtering, or load balancing data before it reaches the indexers.

B. All Intermediate Forwarders must be Heavy Forwarders is the correct answer. Heavy Forwarders are the only type of forwarder that can perform the necessary tasks required of an Intermediate Forwarder, such as parsing data, applying transformations, and routing based on specific rules. Universal Forwarders are lightweight and cannot perform these complex tasks, thus cannot serve as Intermediate Forwarders.

Splunk Documentation

Reference: Intermediate Forwarders