topic Re: Splunk Universal Forwareder porformance impact in Getting Data In

Splunk Universal Forwareder porformance impact

aaronhernandez — Tue, 16 Apr 2019 16:47:30 GMT

Hello.

Do you know if exist a table, web page, benchmark or paper where the impact to performance for the appliances where an Universal Forwarder is installed on is shown?

Re: Splunk Universal Forwareder porformance impact

pruthvikrishnap — Tue, 16 Apr 2019 21:48:07 GMT

Hi Aaron,
There is no specific benchmark/table which specifies the performance of universal forwarders. It completely depends on the way universal forwarder is used, if for example a universal forwarder is set to monitor a million directories and options such as "ignoreOlderThan" is not set, UF will have to monitor all the files available.
Other most performance impact is misplacement of wildcard, if a wildcard is specified in that log path and there are other folders which could be matched with the wildcard it would be a performance hit.
Below are few linux command which i use to check the performance of UF
https://geekflare.com/linux-performance-commands/

Re: Splunk Universal Forwareder porformance impact

adonio — Wed, 17 Apr 2019 01:25:59 GMT

@aaronhernandez, for servers, kindly refer to @pruthvikrishnapolavarapu comment.
In your question you are referring to appliances in 99% of the cases, you will not be able to install a forwarder on appliances.
to bring this kind of data, please read here:
https://docs.splunk.com/Documentation/Splunk/7.2.5/Data/Monitornetworkports

hope it helps