Splunk Enterprise

Best practice for splunk

Path Finder


I want to gather log file of several machine that performance of those machine really important for me, now these question come to my mind.

1-when i use forwarder how much of resource use by splunk forwarders?(i know it depend to lots of parameters but need to know approximately how much estimation)

2-is it better to use syslog to gather log in centralize server after that splunk analyze them? (Splunk forwarder compress and encrypt logs when send it to log server that use resources)

3-any best practice or use case exist for this aim?



Labels (3)
0 Karma


1 - There are many factors, but a UF typically uses <2% of resources.

2 - Syslog data should be sent using native methods to a central syslog server.  From there, a UF can be used to send the data to Splunk.

If this reply helps you, an upvote would be appreciated.
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!