https://community.splunk.com/t5/Getting-Data-In/Recommended-no-of-forwarders-for-a-receiver/m-p/31308#M5498 <P>I would like to find out if there's a recommended value for no of universal forwarders to connect to a receiver. We have about 130 end-user computers to monitor. Is it a good idea to connect them all to one receiver at one port? If not, what's the best practice, or the minimal system requirement for the receiver machine? </P> Thu, 08 Dec 2011 09:29:59 GMT wanling 2011-12-08T09:29:59Z https://community.splunk.com/t5/Getting-Data-In/Recommended-no-of-forwarders-for-a-receiver/m-p/31308#M5498 <P>I would like to find out if there's a recommended value for no of universal forwarders to connect to a receiver. We have about 130 end-user computers to monitor. Is it a good idea to connect them all to one receiver at one port? If not, what's the best practice, or the minimal system requirement for the receiver machine? </P> Thu, 08 Dec 2011 09:29:59 GMT https://community.splunk.com/t5/Getting-Data-In/Recommended-no-of-forwarders-for-a-receiver/m-p/31308#M5498 wanling 2011-12-08T09:29:59Z https://community.splunk.com/t5/Getting-Data-In/Recommended-no-of-forwarders-for-a-receiver/m-p/31309#M5499 <P>130 forwarders is no problem. The limits lie in the operating system's ability to create sockets rather than what Splunk itself can cope with. See the excellent answers to a very similar question here: <A href="http://splunk-base.splunk.com/answers/4097/is-there-a-maximum-number-of-forwarders-per-indexer">http://splunk-base.splunk.com/answers/4097/is-there-a-maximum-number-of-forwarders-per-indexer</A></P> Thu, 08 Dec 2011 09:39:28 GMT https://community.splunk.com/t5/Getting-Data-In/Recommended-no-of-forwarders-for-a-receiver/m-p/31309#M5499 Ayn 2011-12-08T09:39:28Z https://community.splunk.com/t5/Getting-Data-In/Recommended-no-of-forwarders-for-a-receiver/m-p/31310#M5500 <P>Thanks Ayn. My splunk server is on windows 2008 R2 platform, using Intel Xeon CPU E5450 @3GHz (2 processors) and 16 GB RAM. Any comments on this spec?</P> Thu, 08 Dec 2011 10:03:55 GMT https://community.splunk.com/t5/Getting-Data-In/Recommended-no-of-forwarders-for-a-receiver/m-p/31310#M5500 wanling 2011-12-08T10:03:55Z https://community.splunk.com/t5/Getting-Data-In/Recommended-no-of-forwarders-for-a-receiver/m-p/31311#M5501 <P>That looks just fine! This is good reference material: <A href="http://docs.splunk.com/Documentation/Splunk/latest/installation/capacityplanningforalargersplunkdeployment">http://docs.splunk.com/Documentation/Splunk/latest/installation/capacityplanningforalargersplunkdeployment</A></P> Thu, 08 Dec 2011 11:01:24 GMT https://community.splunk.com/t5/Getting-Data-In/Recommended-no-of-forwarders-for-a-receiver/m-p/31311#M5501 Ayn 2011-12-08T11:01:24Z