When monitoring and forwarding events collected from a file containing unstructured textual events, what is the difference in the Splunk2Splunk payload traffic sent between a universal forwarder (UF) and indexer compared to the Splunk2Splunk payload sent between a heavy forwarder (HF) and the indexer layer?
(Assume that the file is being monitored locally on the forwarder.)
The universal forwarder (UF) sends a stream of data where a single set of metadata fields is used to represent the entire stream, making the payload size smaller. On the other hand, a heavy forwarder (HF) sends individual events, each with their own metadata fields attached, leading to a larger payload. This difference arises because the HF processes and parses the events before forwarding, while the UF simply forwards the raw data.
B is the correct
B - Page 6