Explain the roles of a Splunk forwarder, indexer, and search head.

Explain the roles of a Splunk forwarder, indexer, and search head.

• A. Forwarder stores data; indexer searches; search head ingests data.
• B. Forwarder collects data; indexer stores and enables searches; search head runs searches and coordinates across indexers.
• C. Forwarder runs searches; indexer distributes dashboards; search head stores data.
• D. Forwarder distributes dashboards; indexer ingests data; search head manages user roles.

Answer: (B)