In Splunk data ingestion, which statement correctly differentiates a Universal Forwarder from a Heavy Forwarder?

In Splunk data ingestion, which statement correctly differentiates a Universal Forwarder from a Heavy Forwarder?

• A. A Heavy Forwarder is lighter than a Universal Forwarder and handles only local storage.
• B. A Universal Forwarder is lightweight and forwards raw data; a Heavy Forwarder can parse, index, route data and run apps.
• C. Both perform exactly the same tasks; the difference is purely administrative.
• D. A Universal Forwarder can parse and index data; a Heavy Forwarder only forwards raw data.

Answer: (B)