1) There is a slightly larger overhead, of course, and the fact that there is a server listening on incoming http-requests. There have been a few vulnerabilities in previous versions of SplunkWeb. 2) Yes 3) Not too much, unless you actually use the heavy forwarder as a SearchHead towards the indexer(s). Then it will consume large amounts of memory an CPU. This can also happen if the forwarder is monitoring a very large amount of files (hundreds or thousands), regardless of whether the web interface is enabled or not. Suggestion, disable the web GUI and use Deployment Server for all configuration. hope this helps, Kristian ... View more

Well, you generally shouldn't modify items in default/* because they get overwritten on upgrade. You should instead override the setting in local/*. But the Unix app is disabled overall by default, so you would need to enable it by creating a local/app.conf with the "state = enabled" setting. (See default/app.conf) ... View more