Splunk doesn't employ an agent. What you are looking for, is information on the Splunk Universal Forwarder, an unobtrusive "listening" service that forwards data to the indexer or a Splunk Heavy Forwarder which has more features and functions, including the ability to index locally, therefore requires a bit more resource. You'll want to read through the documentation on the subject, even if your fellow Splunk customers share their stories, it will help to be more familiar with the terminology and function of each component. Here is a good starting point for a windows installation: http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/DeployaWindowsdfmanually#Before_you_install Your questions regarding credentials are answered there. You may also want to read the prior sections which discuss the concept of forwarding in general. Technical Support is available as part of your Enterprise License. You should confirm with your Sales Account Manager as to whether that is included in your license agreement. In general, performance issues are considered minimal, however benchmarking is recommended so that you understand how much data you are going to be Splunking (what events types exactly,?what is the volume on that particular server,? will you include performance counters also?) you will be best prepared to calculate the impact. ... View more