Questions on a Splunk Forwarder

crt89 — Thu, 15 May 2014 02:53:57 GMT

Good day Splunkers,

Would like to ask some questions on the universal forwarder.

What is the minimum CPU usage? Given that we configured the forwarder as default with a minimum of 3 log files being monitored and forwarded.
What is its disk I/O requirements?

Thanks,

Re: Questions on a Splunk Forwarder

MuS — Thu, 15 May 2014 05:40:02 GMT

Hi crt89,

basically you can say, that the impact of the universal forwarder is very low. You can see maybe some CPU and IO peak during initial load of old logs. But during daily business the load should stay at a low one numbered percent.

The load will increase, the more file will be observed by the UF.

Regarding the minimum requirements, here is a basic rule - if you depend on near real-time events use fast CPU's and high IO disks. If you don't ... well, I run an UF on an ARMv5te 1.2Ghz mini server with an old 2.5" USB2 disk attached and it runs fine.

To sum this up: it really depends on your use case, if you need special fast CPU and high IO disks or not.

You can also check the system requirement docs and get some CPU info's for the UF.

hope this helps ...

cheers, MuS

topic Re: Questions on a Splunk Forwarder in Getting Data In

Questions on a Splunk Forwarder

Re: Questions on a Splunk Forwarder