I am assuming you mean to ask the consumption of a Splunk instance when used in Forwarding mode. Memory consumption is mostly determined by the type of inputs you are monitoring. A non-active Splunk process should not utilize much more than a 100 MB of RAM when in a Forwarding mode. The light-forwarding mode offers the least overhead. If the system is actively monitoring large files, I would expect RAM usage to increase proportionately to the files themselves. As for CPU, this is also dictated by the type of inputs you are using.
Whe only want to log syslog and who.
If you can detail the types of inputs you will be configuring, that will allow for a better answer.
I am assuming you mean to ask the consumption of a Splunk instance when used in Forwarding mode. Memory consumption is mostly determined by the type of inputs you are monitoring. A non-active Splunk process should not utilize much more than a 100 MB of RAM when in a Forwarding mode. The light-forwarding mode offers the least overhead. If the system is actively monitoring large files, I would expect RAM usage to increase proportionately to the files themselves. As for CPU, this is also dictated by the type of inputs you are using.