Which forwarder type can parse data prior to forwarding?
Which forwarder type can parse data prior to forwarding?
A heavy forwarder can parse data before forwarding it. This forwarder type allows for advanced processing and routing of data based on its content, which are not functions supported by a universal forwarder. The heavy forwarder is capable of handling the parsing phase, wherein data is broken up into events and additional processing is conducted.
D. Heavy forwarder
Per the provided Reference URL https://docs.splunk.com/Documentation/Splunk/7.3.1/Forwarding/Typesofforwarders "A heavy forwarder parses data before forwarding it and can route data based on criteria such as source or type of event."
D is correct
"The universal forwarder does not parse data. You cannot use it to route data to different Splunk indexers based on its contents.", so the answer is Heavy Forwarder Source: https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Typesofforwarders
both indexers and heavy forwarders parse events
Heavy forwarder
Option D Parsing phase: Handled by indexers (or heavy forwarders) - Data is broken up into events and advanced processing can be performed