Best practice for splunk

[indeed_2000]

Hi

I want to gather log file of several machine that performance of those machine really important for me, now these question come to my mind.

1-when i use forwarder how much of resource use by splunk forwarders?(i know it depend to lots of parameters but need to know approximately how much estimation)

2-is it better to use syslog to gather log in centralize server after that splunk analyze them? (Splunk forwarder compress and encrypt logs when send it to log server that use resources)

3-any best practice or use case exist for this aim?

Thanks,

[richgalloway]

1 - There are many factors, but a UF typically uses <2% of resources.

2 - Syslog data should be sent using native methods to a central syslog server.  From there, a UF can be used to send the data to Splunk.