What are the three main Splunk components?

A distributed Splunk Enterprise deployment is fundamentally composed of three main components. Forwarders are installed on source machines to collect and send data. Indexers receive, process, and store the data in flat files organized into directories called buckets. Search heads provide the user interface for users to run searches, create reports, and build dashboards; they coordinate search activities across the set of indexers and consolidate the results to present back to the user. This separation of roles allows the Splunk environment to scale effectively for handling large data volumes and user loads.

A: A GPU (Graphics Processing Unit) is a hardware component, not a Splunk software component, and "streamer" is not an official Splunk term.

C: Splunk uses a proprietary, non-relational index for data storage, not a SQL database, as a core component.

D: An SSD (Solid State Drive) is a type of storage hardware, not a Splunk software component. "Heavy weight agent" is an informal term for a heavy forwarder.

1. Splunk Enterprise Documentation

Distributed Deployment Manual

"Splunk Enterprise components" section. This section explicitly states

"A Splunk Enterprise deployment typically consists of three main components: indexers

search heads

and forwarders." It proceeds to detail the function of each.

2. Splunk Enterprise Documentation

Splunk Enterprise Overview

"How Splunk Enterprise works" section. This part of the manual describes the data pipeline

identifying the roles of forwarders for data input

indexers for parsing and indexing

and search heads for data searching and retrieval.

3. Splunk

Splunk Fundamentals 1 (Courseware for SPLK-1001). Module 2

"What is Splunk?"

contains a lesson on "Splunk Components" which introduces forwarders

indexers

and search heads as the main processing tiers of a Splunk deployment.