Getting Data In

Reduce Splunk Forwarder RAM usage

FRoth
Contributor

We are using a splunk universal forwarder on our virtual server systems and noticed that every instance uses about 70-80MB of RAM. This is more than 1800 MB of RAM on our 25 virtual systems.

Is there a way to reduce the memory usage of the Universal Forwarder by limiting a cache queue size or something?

0 Karma
1 Solution

rturk
Builder

The author of the answer works for Splunk (head of engineering from memory) and knows the product inside out, back-to-front, and side-to-side... so his answer is about as definitive as it gets I'm afraid.

View solution in original post

0 Karma

rturk
Builder

The author of the answer works for Splunk (head of engineering from memory) and knows the product inside out, back-to-front, and side-to-side... so his answer is about as definitive as it gets I'm afraid.

0 Karma

FRoth
Contributor
0 Karma
Get Updates on the Splunk Community!

Set Up More Secure Configurations in Splunk Enterprise With Config Assist

This blog post is part 3 of 4 of a series on Splunk Assist. Click the links below to see the other ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Enterprise Security Content Update (ESCU) v3.54.0

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and ...