What is the difference between Universal Forwarder and Heavy Forwarder?

The Universal Forwarder and Heavy Forwarder installers are different.
Universal Forwarder will be a smaller installer with specialized features for collecting and forwarding data, while Heavy Forwarder will be the same installer as regular indexing servers.

If you want to mask some data during forwarding or perform advanced filtering, you need to use Heavy Forwarder.
For simple data collection and transfer, we recommend using Universal Forwarder.

In addition, there is a description about the difference of each forwarder below, so please refer to it.

http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Typesofforwarders