I got the bad news:
Hello Bill,
There isn't a way to limit the amount of memory being used by a forwarder directly. What you can do is to turn off inputs and/or descrease the threshold of inputs that run on an interval, like scripted inputs such as perfmon/wmi/etc.
However, Splunk recommends that we use 5.0.3 of the forwarder:
If you want to move to 5.0.3, that is fine too, it contains a number of fixes for splunk-admon.exe related to memory.
So I'm not happy about the memory use, but I'd rather have the log data.
... View more