https://community.splunk.com/t5/Getting-Data-In/Has-anyone-compared-the-performance-and-resource-usage-on-a/m-p/206125#M40685 <P>All, </P> <P>I have a couple small use cases where a full install of Splunk with the GUI disabled might be better than using a Universal Forwarder. And honestly, just curious. </P> <P>1) Mainly some props manipulation/transforms I want to offload off my existing heavy forwarder tier since I am hardware strapped for Splunk. But the customer has surplus resources left and right. <BR /> 2) And maybe some scripted actions on the server itself, not sure about that just curious</P> <P>Has anyone ever done this? <BR /> Anything obvious silly there I am missing? <BR /> Has anyone compared the base UF vs base Full install overhead for a simple inputs.conf?</P> <P>thanks</P> Fri, 15 Apr 2016 01:38:43 GMT daniel333 2016-04-15T01:38:43Z https://community.splunk.com/t5/Getting-Data-In/Has-anyone-compared-the-performance-and-resource-usage-on-a/m-p/206125#M40685 <P>All, </P> <P>I have a couple small use cases where a full install of Splunk with the GUI disabled might be better than using a Universal Forwarder. And honestly, just curious. </P> <P>1) Mainly some props manipulation/transforms I want to offload off my existing heavy forwarder tier since I am hardware strapped for Splunk. But the customer has surplus resources left and right. <BR /> 2) And maybe some scripted actions on the server itself, not sure about that just curious</P> <P>Has anyone ever done this? <BR /> Anything obvious silly there I am missing? <BR /> Has anyone compared the base UF vs base Full install overhead for a simple inputs.conf?</P> <P>thanks</P> Fri, 15 Apr 2016 01:38:43 GMT https://community.splunk.com/t5/Getting-Data-In/Has-anyone-compared-the-performance-and-resource-usage-on-a/m-p/206125#M40685 daniel333 2016-04-15T01:38:43Z https://community.splunk.com/t5/Getting-Data-In/Has-anyone-compared-the-performance-and-resource-usage-on-a/m-p/206126#M40686 <P>If my testing (which I'll admit was limited but was at least cursory) was correct, most of the load in Splunk is generated by "what you are doing." Given a UF and a full install configured with the same inputs and reading the same files, the difference should be relatively minor.</P> Fri, 15 Apr 2016 02:31:27 GMT https://community.splunk.com/t5/Getting-Data-In/Has-anyone-compared-the-performance-and-resource-usage-on-a/m-p/206126#M40686 Richfez 2016-04-15T02:31:27Z