What are the three main Splunk components?

A distributed Splunk Enterprise deployment is fundamentally composed of three main components. Forwarders are installed on source machines to collect and send data. Indexers receive, process, and store the data in flat files organized into directories called buckets. Search heads provide the user interface for users to run searches, create reports, and build dashboards; they coordinate search activities across the set of indexers and consolidate the results to present back to the user. This separation of roles allows the Splunk environment to scale effectively for handling large data volumes and user loads.

A: A GPU (Graphics Processing Unit) is a hardware component, not a Splunk software component, and "streamer" is not an official Splunk term. C: Splunk uses a proprietary, non-relational index for data storage, not a SQL database, as a core component. D: An SSD (Solid State Drive) is a type of storage hardware, not a Splunk software component. "Heavy weight agent" is an informal term for a heavy forwarder.

1. Splunk Enterprise Documentation, Distributed Deployment Manual, "Splunk Enterprise components" section. This section explicitly states, "A Splunk Enterprise deployment typically consists of three main components: indexers, search heads, and forwarders." It proceeds to detail the function of each.

2. Splunk Enterprise Documentation, Splunk Enterprise Overview, "How Splunk Enterprise works" section. This part of the manual describes the data pipeline, identifying the roles of forwarders for data input, indexers for parsing and indexing, and search heads for data searching and retrieval.

3. Splunk, Splunk Fundamentals 1 (Courseware for SPLK-1001). Module 2, "What is Splunk?", contains a lesson on "Splunk Components" which introduces forwarders, indexers, and search heads as the main processing tiers of a Splunk deployment.