Skip to content OpenLabs

Splunk Visual Handbook phase 1 · Where the data comes in

A universal forwarder does not parse

The machine that reads your log file is the one machine in the path that does not understand it. It cuts the stream into 64K blocks, tags each block with where it came from, and forwards — so every setting about what an event is has no effect there, and the ones that do have effect are a different, shorter list.

Primary sources

Cited above by name. Where a source has no link it is because none is stable enough to print — the citation is what you search for.

  1. Splunk Inc. (current). Types of forwarders. Splunk Enterprise documentation.

    The two forwarders side by side. Read it for what the universal forwarder is said not to do, which is the half that gets skipped: it does not parse data except in certain limited situations, and what it forwards is unparsed.

  2. Splunk Inc. (current). Splexicon: universal forwarder. Splunk documentation glossary.

    Four sentences, and one of them is the whole of this article: its main limitation is that it forwards only unparsed data. The glossary is worth more than its size here, because this is the sentence nobody quotes.

  3. Splunk Inc. (current). How Splunk Enterprise handles your data. Splunk Enterprise documentation.

    The four phases, and the only page that says what the input phase physically produces: 64K blocks, each annotated with metadata keys including host, source and source type. Before parsing runs, there is no event.

  4. Splunk Inc. (current). Configuration parameters and the data pipeline. Splunk Enterprise admin manual.

    The table that maps every setting to the phase it belongs to, and the rule under it: each configuration belongs on only one component, the first in the deployment that handles that phase. Most Splunk configuration mistakes are one line of this page.

  5. Splunk Inc. (current). Use EVENT_BREAKER on Universal Forwarder for better data distribution across indexers. Splunk support knowledge base.

    The one line-related setting that is valid on a universal forwarder, and why it exists: not to decide what an event is, but to let load balancing switch receivers at the end of one.

  6. Splunk Inc. (current). Splexicon: source type. Splunk documentation glossary.

    Short, and it corrects the common reading: a source type identifies the data structure of an event and determines how the platform formats the data during indexing. It is not a search label.

  7. Splunk Inc. (current). outputs.conf. Splunk Enterprise configuration file reference.

    Where the forwarder's side of delivery is defined. Look up useAck and note the default, which is the kind of default that decides what happens to your data during a restart you planned.

  8. Splunk Inc. (current). Intermediate data routing using universal and heavy forwarders. Splunk Validated Architectures.

    The page to read before putting anything in the middle of the path, because it treats the intermediate tier as a decision with costs rather than as a hop.