Which two Splunk components are the only two components that can reside on-premise?

The Universal Forwarder and the Intermediate/Heavy Forwarder are the two components of Splunk that can reside on-premise.

The Universal Forwarder is designed to collect data from a wide range of sources and sends it to Splunk for indexing. It is lightweight and runs on various operating systems without consuming excessive resources. This makes it suitable for on-premise deployment, where there may be resource constraints or specific data collection needs.

The Intermediate/Heavy Forwarder serves as a more advanced data forwarding mechanism. It can parse and index data before forwarding it to the Splunk Cloud or a Splunk Indexer. Its capabilities can be utilized for both data transformation and routing, making it a powerful addition to on-premise setups where data needs to be pre-processed before transmission to the cloud environment.

Other options mistakenly include components like the Indexer, Search Head, or Manager Node, which are not suitable for on-premise placements in the context of Splunk Cloud deployment. The nature of Splunk Cloud emphasizes centralized management in the cloud, while the components mentioned in the correct answer are compatible with local environments.