Universal Forwarder hardware requirements

splunkcol · ‎01-20-2021

When an administrator asks me what are the requirements for the Universal forlwarder, I proceed to consult the documentation and find this:

Recommended	Dual-core 1.5GHz+ processor, 1GB+ RAM
Minimum	1.0Ghz processor, 512MB RAM, 5GB of free disk space

The server administrator considers the requirements to be very high.

Is there any more detailed information on agent consumption both at the machine and disk level?

tscroggins · ‎01-20-2021

CPU and memory use vary with input volume and complexity, but local disk use of 1500 MB to 2000 MB is normal given how Splunk manages the fishbucket directory.

Universal Forwarder hardware requirements

Linux

universal forwarder

Windows

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Build resilience for the agentic era: Join us at Splunk Go San Jose

Manage Edge Processor pipelines end to end with APIs

Join the Conversation

Universal Forwarder hardware requirements

Linux

universal forwarder

Windows

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Build resilience for the agentic era: Join us at Splunk Go San Jose

Manage Edge Processor pipelines end to end with APIs