Enlist major components of Splunk?

The three main components in Splunk are

1. Splunk Forwarder,
2. Splunk Indexer, and
3. Splunk Head.

Splunk Forwarder - This component is used for collecting logs. They are independent of the main Splunk instance and are used to collect logs from the remote machine. After collecting the logs, the Splunk Forwarder will forward the log data to a Splunk Indexer for processing and storage.

Splunk Indexer - It is used for indexing and storing the data from the Splunk forwarder. As it indexes the data, the Splunk Indexer creates a number of files. These files contain any one of either item like the raw data in compressed form or the indexes that point to raw data.

Splunk Search Head - This component is used for interacting with the Splunk. It provides GUI for the user to do various operations with the Splunk.