Getting Data In

How many log sources can be received and forwarded from a universal forwarder?

evang_26
Communicator

Hi users,

Probably a bit silly question, but because I've never seen that setup in any of Google searches, I have that simple question:

I want to use a forwarder to forward logs from about 50 Windows machines. Would that single (universal forwarder) be able to receive and forward logs from all those machines? Would that be an acceptable setup?

Regards

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

A single forwarder should be able to support that load, but I think you'd be better off installing a Universal Forwarder on each Windows machine. Running forwarders locally makes for easier access to log files. See Considerations for deciding how to monitor remote Windows data.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

A single forwarder should be able to support that load, but I think you'd be better off installing a Universal Forwarder on each Windows machine. Running forwarders locally makes for easier access to log files. See Considerations for deciding how to monitor remote Windows data.

---
If this reply helps you, Karma would be appreciated.

evang_26
Communicator

Does that apply only for Windows logs? Because actually, I have another 50+ Linux hosts as well.

Regards

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The chapter on monitoring remote Windows data applies only to Windows machines. For Linux, I recommend installing the Splunk for Unix app.

---
If this reply helps you, Karma would be appreciated.
0 Karma

evang_26
Communicator

Right, okay. so in any way, having the forwarders installed on the source system itself is always a better option.

Okay, thanks!

0 Karma
Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Hi Splunky people! We are excited to share the newest updates in Splunk Enterprise 9.3!Admins and Analyst can ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...