Getting Data In

Splunk Universal Forwareder porformance impact



Do you know if exist a table, web page, benchmark or paper where the impact to performance for the appliances where an Universal Forwarder is installed on is shown?

0 Karma

Ultra Champion

@aaronhernandez, for servers, kindly refer to @pruthvikrishnapolavarapu comment.
In your question you are referring to appliances in 99% of the cases, you will not be able to install a forwarder on appliances.
to bring this kind of data, please read here:

hope it helps

0 Karma


Hi Aaron,
There is no specific benchmark/table which specifies the performance of universal forwarders. It completely depends on the way universal forwarder is used, if for example a universal forwarder is set to monitor a million directories and options such as "ignoreOlderThan" is not set, UF will have to monitor all the files available.
Other most performance impact is misplacement of wildcard, if a wildcard is specified in that log path and there are other folders which could be matched with the wildcard it would be a performance hit.
Below are few linux command which i use to check the performance of UF

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...