Splunk Universal Forwarder

Splunk Universal Forwarder is a lightweight agent that streams data from a host to a receiver, usually a Splunk platform index. It monitors data in real time, tags it with source, source type, and host metadata, and supports buffering, compression, and SSL. On Windows, it can collect event logs, performance counters, and registry changes. It has no user interface, which helps minimize resource use.