The third component of Splunk in our list is the universal forwarder, which is also referred as Splunk
agent.
The universal forwarder are used to collect data from remote data sources.
When I say remote data sources, it can be anything that is holding data.
It can be a flat file, log files, scripts, or database logs.
Web server logs.
Any remote machine with just data.
We can install a universal forwarder to fetch that data and feed it to our Splunk environment for further
processing.
The universal forwarder is a lightweight package.
All it can do is to fetch the data and send to other Splunk instances.
It can also run scripts to collect the data on local or remote machines.
Installation of universal forwarder for collecting data is highly recommended for fetching data from
the remote machines.
It has very little overhead on CPU and RAM, which is negligible when consider to other processes to
define universal for what it is a lightweight component of Splunk, which fetches the data from flat
files or scripts and sends it to other components of Splunk for processing of the data.
Further up the chain.