https://community.splunk.com/t5/Getting-Data-In/What-are-the-system-requirements-for-an-AMI-Linux-VM-Heavy/m-p/260801#M50045 <P>Hi All,</P> <P>We are trying to size an AMI Linux VM Heavy Forwarder for a new installation of 6.2.6 and have found the Splunk recommended system requirements of 2x six-core, 2+ GHz CPU, 12 GB RAM at the following link: <A href="http://docs.splunk.com/Documentation/Splunk/6.0/Installation/Systemrequirements#Recommended_hardware">http://docs.splunk.com/Documentation/Splunk/6.0/Installation/Systemrequirements#Recommended_hardware</A> but there is no specific mention of the requirements for a Heavy Forwarder anywhere that we can find in any Splunk documentation.</P> <P>We have found high level reference to the fact a forwarder can be of a lower spec that the above as it will not be doing as much indexing as an indexer, but no quantification as to what that less may be...</P> <P>Any guidance or advice that anyone can provide would be much appreciated.</P> <P>Thanks</P> Mon, 23 May 2016 02:21:40 GMT grimesrichard 2016-05-23T02:21:40Z https://community.splunk.com/t5/Getting-Data-In/What-are-the-system-requirements-for-an-AMI-Linux-VM-Heavy/m-p/260801#M50045 <P>Hi All,</P> <P>We are trying to size an AMI Linux VM Heavy Forwarder for a new installation of 6.2.6 and have found the Splunk recommended system requirements of 2x six-core, 2+ GHz CPU, 12 GB RAM at the following link: <A href="http://docs.splunk.com/Documentation/Splunk/6.0/Installation/Systemrequirements#Recommended_hardware">http://docs.splunk.com/Documentation/Splunk/6.0/Installation/Systemrequirements#Recommended_hardware</A> but there is no specific mention of the requirements for a Heavy Forwarder anywhere that we can find in any Splunk documentation.</P> <P>We have found high level reference to the fact a forwarder can be of a lower spec that the above as it will not be doing as much indexing as an indexer, but no quantification as to what that less may be...</P> <P>Any guidance or advice that anyone can provide would be much appreciated.</P> <P>Thanks</P> Mon, 23 May 2016 02:21:40 GMT https://community.splunk.com/t5/Getting-Data-In/What-are-the-system-requirements-for-an-AMI-Linux-VM-Heavy/m-p/260801#M50045 grimesrichard 2016-05-23T02:21:40Z https://community.splunk.com/t5/Getting-Data-In/What-are-the-system-requirements-for-an-AMI-Linux-VM-Heavy/m-p/260802#M50046 <P>Hi, it all depends on the load and what you are planning to do.</P> <P>If your heavy forwarder is just doing some basic parsing and forwarding but it's not indexing and searching, you can run it in a much smaller VM.</P> <P>For instance, one of my customers has more than 20 heavy forwarders and the specs are very different, but they all work fine:</P> <UL> <LI>From 2x2 cores to 2x4 cores</LI> <LI>From 4 to 8 GB RAM</LI> <LI>From 100 to 200 GB allocated to /opt</LI> <LI>Shared VM resources</LI> <LI>1 Gbps network card</LI> </UL> <P>Hope that helps,<BR /> J</P> Mon, 23 May 2016 08:40:19 GMT https://community.splunk.com/t5/Getting-Data-In/What-are-the-system-requirements-for-an-AMI-Linux-VM-Heavy/m-p/260802#M50046 javiergn 2016-05-23T08:40:19Z https://community.splunk.com/t5/Getting-Data-In/What-are-the-system-requirements-for-an-AMI-Linux-VM-Heavy/m-p/260803#M50047 <P>Thanks Javiergn,</P> <P>We ended up using another windows HF spec as a place to start and will monitor performance.</P> <P>I think your approach to using other working instances as a base for comparison is the best answer at this time so I've accepted your answer.</P> <P>Apologies for the delay in the response.</P> <P>Cheers</P> Thu, 16 Jun 2016 00:13:50 GMT https://community.splunk.com/t5/Getting-Data-In/What-are-the-system-requirements-for-an-AMI-Linux-VM-Heavy/m-p/260803#M50047 grimesrichard 2016-06-16T00:13:50Z