Splunk forwarder in regulated environment

[FGo]

Dear Splunk Experts,

We plan using your product in a regulated environment, having a question on the (heavy) forwarder.
In such area, installation of a product requires proving the absence of retroactive effects on the base system.
1) Your product offers remote access to the base system, offering great convenience, but thereby potentially modifying the base system, offending the above requirement. Is there a reloably means to prevent a forwarder from offering this feature?
2) Can you give upper limits for memory and CPU resource usage? Again, this is required for a tool that aims at being suitable for installation in the regulated environment we find us in.
3) Do you keep service records for products with a given version, so that one could take credit from showing successful use of the product in a significant amount of cases? This typically includes track records on known issues.

Thanks in advance for your effort,
best regards,
Frank

[FGo]

Thanks for your answer, so I will look forward contacting sales!

[richgalloway · Accepted solution]

These questions probably should be directed to your Splunk sales team.  This is a community forum and we members of the community can't answer all of these questions, especially #3.

Regarding question #1, the only part of the file system a forwarder writes to is the directory in which Splunk runs (/opt/splunk by default).

How much system resources a heavy forwarder (HF) uses depends on how the HF is used, but usually it's relatively small.  Actions like transforming or queuing can cause more resources to be used.