Question: what is the difference between universal forwarder and heavy forwarder?
Answer: A Universal Forwarder has no capability to parse data some metadata stamping on the events. A Heavy Forwarder is a full Splunk Instance with all the capabilities of Splunk Enterprise. You can simultaneously use a Heavy Forwarder to send data (just like a Universal Forwarder does) and also parse and Index data.