Howdy Splunkers! First post here.
I am looking for any information on the amount of resources a Universal Forwarder potentially uses on the server it is installed on when we are collecting IIS and/or winevent logs. All I can find in Splunk Community is "Universal forwarders use limited resources" which doesn't help me much.
As part of my onboarding process of bringing server logging into Splunk, I want to make sure that we consider the host resource usage as part of the considerations in the deployment planning in addition to the customary storage capacity those logs will need.
Currently, I need to install a UF on an IIS server which is extremely over-used and I want to try to understand how much the UF will add to the host server as I need to make sure the extra resource usage won't negatively affect or bring down the server.
I appreciate your time and hope this makes sense. Thank you so much for your help!
Addition to @gcusello comments, memory usage can go higher if output data rate is higher than maxKBps (default 256 KBps) value continuously. On busy servers you should set it to higher or unlimited, keep monitoring the output and increase if necessary.