The next component is the EV forwarder, as the name suggests, its heavy instance.
It requires its own infrastructure to operate when compared with universal forwarder.
It has additional capabilities of passing on storage of the data.
But.
Henry V for water.
It is highly recommended not to store any data because it will be a duplication since your indexer is
also storing the data and it comes with an added cost of the storage on the heavy forwarder.
Every forward passes the data and sends it to the indexer.
The parsing involves.
Masking of your data filtering out noise from the logs and also IP forwarder will help improve indexer
performance by decreasing the load of parsing.
When we say passing it is the breaking down of events into smaller, manageable pieces.
So.
It will help improve indexer performance by decreasing the load of passing on the indexer.
The every forward is usually optional component and small and medium enterprises.
The need for having a heavy forwarder will be in the hands of Splunk admin or the architect to go for
the heavy forwarder or not.
Having a forward gives you following benefits like masking of the data filtering.
Of the noise and reducing load on the index.
All these can be done using the index, Rachel, but it comes with additional processing cost of the
index.
Always remember if your indexer performance is good, your overall Splunk performance will be good.
So in order to improve performance on the index, we can have heavy forwarder masking filtering to reduce
the passing load on the index.
We can always afford every forwarder.
But it's still an optional component.
It is good to evaluate the option of having heavy forward in any environment.