Has anyone compared the performance and resource usage on a universal forwarder versus a full Splunk Enterprise install for a simple inputs.conf?

[daniel333]

All,

I have a couple small use cases where a full install of Splunk with the GUI disabled might be better than using a Universal Forwarder. And honestly, just curious.

1) Mainly some props manipulation/transforms I want to offload off my existing heavy forwarder tier since I am hardware strapped for Splunk. But the customer has surplus resources left and right.
2) And maybe some scripted actions on the server itself, not sure about that just curious

Has anyone ever done this?
Anything obvious silly there I am missing?
Has anyone compared the base UF vs base Full install overhead for a simple inputs.conf?

thanks

[Richfez]

If my testing (which I'll admit was limited but was at least cursory) was correct, most of the load in Splunk is generated by "what you are doing." Given a UF and a full install configured with the same inputs and reading the same files, the difference should be relatively minor.