Splunk Universal Forwarder to Heavy Forwarder Pipeline Architecture: Design, Trust Boundaries, and Operational Guardrails
Architecture note on the smallest viable Splunk pipeline: Universal Forwarders → load-balanced Heavy Forwarder cluster → Indexers. Covers trust boundaries at the HF layer, persistent queuing configs, blocked-queue monitoring, failure-mode mitigations, and when to graduate to Indexer Clustering.
splunk