Monitoring Splunk

forwarders constantly running

jszyba
New Member

Is there any way to have a forwarder process not constantly running but rather start up every x hours or so? I'm trying to avoid tying up to many resources on the server as the Splunk universal service seems to constantly consume 65MB of memory.

Tags (2)
0 Karma

kaufmanm
Communicator

jayzba, one way to do this would be with Windows scheduled tasks or Linux's cron.

In Windows, you'd write two .cmd batch files, one that stops the service and one that starts the service.

stopSplunk.cmd would contain:
sc stop UniversalForwarder

startSplunk.cmd would contain
sc start UniversalForwarder

Then you'd schedule startSplunk to run at the top of every hour and run stopSplunk five minutes after every hour, or whatever particular times you're okay with Splunk running. e.g. If it can't run during business hours you could use these to start Splunk once a day in the middle of night or such.

In Linux you could put the command directly into cron:
0 * * * * * * * /opt/splunkforwarder/bin/splunk start
5 * * * * * * * /opt/splunkforwarder/bin/splunk stop

kaufmanm
Communicator

Splunk is stopped, but Scheduled Tasks or cron respectively are not, and will run the scripts or commands when the time comes.

aelliott
Motivator

you may be able to lower resources by only allowing a certain amount of traffic through:
http://answers.splunk.com/answers/53138/maximum-traffic-of-a-universal-forwarder

0 Karma

MuS
Legend

Hi jszyba,

sure, you can start and stop the universal forwarder for example by cron. The UF will pick up reading files where it left. The amount of memory used by the UF is mainly driven by the amount of files monitored by the UF, for example directories with a large number of files in it like rotated logs. Try to set your UF only to monitor the most recent files you need and set it to ignore rotated files by using for example ignoreOlderThan in inputs.conf or set the monitor stanza to the log file name you need.

hope this helps ...

cheers, MuS

jszyba
New Member

Can you give me an example of how I would start the UF every hour or so?

0 Karma
Get Updates on the Splunk Community!

App Building 101 - Build Your First App!

WATCH RECORDING NOW   Tech Talk: App Dev Edition Splunk has tons of out-of-the-box functionality, and you’ve ...

Introducing support for Amazon Data Firehose in Splunk Edge Processor

We’re excited to announce a powerful update to Splunk Data Management with added support for Amazon Data ...

The Observability Round-Up: September 2024

What’s up Splunk Community! Welcome to the latest edition of the Observability Round-Up, a monthly series in ...