Getting Data In

Has anyone compared the performance and resource usage on a universal forwarder versus a full Splunk Enterprise install for a simple inputs.conf?

daniel333
Builder

All,

I have a couple small use cases where a full install of Splunk with the GUI disabled might be better than using a Universal Forwarder. And honestly, just curious.

1) Mainly some props manipulation/transforms I want to offload off my existing heavy forwarder tier since I am hardware strapped for Splunk. But the customer has surplus resources left and right.
2) And maybe some scripted actions on the server itself, not sure about that just curious

Has anyone ever done this?
Anything obvious silly there I am missing?
Has anyone compared the base UF vs base Full install overhead for a simple inputs.conf?

thanks

0 Karma

Richfez
SplunkTrust
SplunkTrust

If my testing (which I'll admit was limited but was at least cursory) was correct, most of the load in Splunk is generated by "what you are doing." Given a UF and a full install configured with the same inputs and reading the same files, the difference should be relatively minor.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...