Questions on a Splunk Forwarder

[crt89]

Good day Splunkers,

Would like to ask some questions on the universal forwarder.

1. What is the minimum CPU usage? Given that we configured the forwarder as default with a minimum of 3 log files being monitored and forwarded.
2. What is its disk I/O requirements?

Thanks,

[MuS · Accepted solution]

Hi crt89,

basically you can say, that the impact of the universal forwarder is very low. You can see maybe some CPU and IO peak during initial load of old logs. But during daily business the load should stay at a low one numbered percent.

The load will increase, the more file will be observed by the UF.

Regarding the minimum requirements, here is a basic rule - if you depend on near real-time events use fast CPU's and high IO disks. If you don't ... well, I run an UF on an ARMv5te 1.2Ghz mini server with an old 2.5" USB2 disk attached and it runs fine.

To sum this up: it really depends on your use case, if you need special fast CPU and high IO disks or not.

You can also check the system requirement docs and get some CPU info's for the UF.

hope this helps ...

cheers, MuS