I want to gather log file of several machine that performance of those machine really important for me, now these question come to my mind.
1-when i use forwarder how much of resource use by splunk forwarders?(i know it depend to lots of parameters but need to know approximately how much estimation)
2-is it better to use syslog to gather log in centralize server after that splunk analyze them? (Splunk forwarder compress and encrypt logs when send it to log server that use resources)
3-any best practice or use case exist for this aim?
1 - There are many factors, but a UF typically uses <2% of resources.
2 - Syslog data should be sent using native methods to a central syslog server. From there, a UF can be used to send the data to Splunk.