Universal Forwarder hardware requirements

[splunkcol]

When an administrator asks me what are the requirements for the Universal forlwarder, I proceed to consult the documentation and find this:

Recommended	Dual-core 1.5GHz+ processor, 1GB+ RAM
Minimum	1.0Ghz processor, 512MB RAM, 5GB of free disk space

The server administrator considers the requirements to be very high.

Is there any more detailed information on agent consumption both at the machine and disk level?

[tscroggins]

CPU and memory use vary with input volume and complexity, but local disk use of 1500 MB to 2000 MB is normal given how Splunk manages the fishbucket directory.