Splunk Components and Architecture
Roles, not products
Splunk deployments are described by role: forwarders collect, indexers store and search, and search heads provide the web UI and coordinate distributed searches. A single-instance install performs all three roles on one machine.
- Universal Forwarder (UF): small footprint, no Splunk Web, no Python; reads inputs and forwards raw data. It can filter and route but does not do full parsing or indexing.
- Heavy Forwarder: full Splunk binary; can parse, filter/route data, and run modular inputs such as scripted or database inputs.
- Indexer: receives data, parses it into events, and writes it to indexes as buckets that roll hot → warm → cold → frozen (thawed = restored from archive).
- Search Head: runs the search job, pushes it to indexers, merges results, renders the interface.
- Supporting roles: Deployment Server (pushes apps and configs to forwarders), Cluster Manager (indexer clustering), SHC Deployer, License Manager.
The pipeline
Data moves input → parsing → indexing → search. Field extraction can happen at index time (props.conf/transforms.conf on the parsing tier) or at search time; the recommended practice is search time, because index-time extraction permanently alters events and requires a rebuild.
Traps
Questions love to swap the tiers. A UF does not index; an indexer normally does not collect remote data (only local inputs); the Deployment Server pushes configuration but stores no event data; the License Manager only meters daily license usage.
Rule of thumb: asked "who parses?" in a distributed environment, answer the indexer or heavy forwarder - never the universal forwarder.