We are using a splunk universal forwarder on our virtual server systems and noticed that every instance uses about 70-80MB of RAM. This is more than 1800 MB of RAM on our 25 virtual systems.
Is there a way to reduce the memory usage of the Universal Forwarder by limiting a cache queue size or something?
The author of the answer works for Splunk (head of engineering from memory) and knows the product inside out, back-to-front, and side-to-side... so his answer is about as definitive as it gets I'm afraid.
The author of the answer works for Splunk (head of engineering from memory) and knows the product inside out, back-to-front, and side-to-side... so his answer is about as definitive as it gets I'm afraid.
