topic Re: Universal Forwarder in Splunk Enterprise

Universal Forwarder

kishorealla — Sat, 12 Mar 2016 17:31:19 GMT

Does Universal Forwarder need JVM ? How can we monitor if a Forwarder goes down.

Re: Universal Forwarder

richgalloway — Sat, 12 Mar 2016 17:55:08 GMT

The Universal Forwarder does not need JVM.

To monitor your forwarders, click Settings->Distributed Management Console. Then click Forwarders->Forwarders:Instance to view the status of your forwarders.

Re: Universal Forwarder

kishorealla — Sun, 13 Mar 2016 12:20:07 GMT

Thanks Rich !! How does it run on Windows or Linux? Or How does a sysadmin identify it on any OS?

Re: Universal Forwarder

richgalloway — Sun, 13 Mar 2016 12:39:30 GMT

There are versions for both Windows and Linux.
I don't understand your second question.

Re: Universal Forwarder

kishorealla — Sun, 13 Mar 2016 13:02:57 GMT

For eg. in Windows, does it run as a java service? Similarly for Linux?

Re: Universal Forwarder

kishorealla — Sun, 13 Mar 2016 13:05:24 GMT

Mainly for a system admin to know how much CPU and Memory it is consuming. I know it is very less, but these are the questions coming from our Admin team.

Re: Universal Forwarder

richgalloway — Sun, 13 Mar 2016 16:49:43 GMT

The Universal Forwarder is not a Java app. It runs as a native binary.
See http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Theuniversalforwarder. Forwarders typically report performance data to Splunk so the admins can monitor CPU and memory use there.