The correct answer is: A. Universal Forwarder or Heavy Forwarder.**
In a **Splunk Cloud** environment, some **input apps** (especially those with custom scripts, modular inputs, or unsupported add-ons) **cannot be installed directly on Splunk Cloud** due to security and system restrictions.
B. Heavy Forwarder only:**
❌ Too limiting — many apps work fine on Universal Forwarders.
C. Universal Forwarder only:**
❌ Some apps require capabilities not available in UFs (e.g., scripted inputs).
D. Apps cannot be installed on on-prem instances:**
❌ False — on-prem forwarders are **specifically where** you **should** install unsupported cloud apps.
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
2dd1c50
1 day, 8 hours agoMaryamNesa
5 months ago