Why are Universal Forwarders recommended for data collection?

Universal Forwarders are recommended for data collection primarily because they are lightweight and efficient. This design allows them to be deployed on various systems with minimal resource impact, making them ideal for collecting data from a wide range of sources. They consume very little CPU and memory, which ensures that the systems they are installed on do not experience significant performance degradation. This efficiency is particularly valuable when deploying multiple forwarders across many machines, as it allows for extensive data collection without overwhelming the infrastructure.

Furthermore, their lightweight nature does not compromise their functionality. Universal Forwarders can handle high volumes of log data and transmit it to a central Splunk instance for indexing and analysis, making them an optimal choice for environments where resource consumption is a concern.

While other options describe certain functionalities of Splunk components, they do not capture the primary reason for using Universal Forwarders in data collection scenarios. The emphasis on being lightweight and efficient aligns perfectly with the needs of organizations aiming to collect diverse data with minimal overhead.