Iam running a test server in a Ligthsail aws, its a bitnami distro with only 512 MB Ram. splunkd RAM usage is more than 90% in large searches, expanded the swap to 12GB solve the problem. Just follow these steps: Make all swap off sudo swapoff -a Resize the swapfile sudo dd if=/dev/zero of=/swapfile bs=1M count=1024 Make swapfile usable sudo mkswap /swapfile Make swapon again sudo swapon /swapfile Note this: Recommended hardware capacity The following requirements are accurate for a single instance installation with light to moderate use. For significant enterprise and distributed deployments, see Capacity Planning. Platform Recommended hardware capacity/configuration Non-Windows platforms 2x six-core, 2+ GHz CPU, 12GB RAM, Redundant Array of Independent Disks (RAID) 0 or 1+0, with a 64 bit OS installed. Windows platforms 2x six-core, 2+ GHz CPU, 12GB RAM, RAID 0 or 1+0, with a 64-bit OS installed. ... View more

now we have the PCAP Analyzer for Splunk APP 🙂 https://splunkbase.splunk.com/app/2748/ ... View more

for those who are looking for initial (basic) cisco configuration: 1- open port 514 in firewall if u have. 2- configure in cisco: logging trap (trap level) logging host (Splunk Server) transport (tcp |> udp) port (514) logging on 3- In Splunk's Data Inputs: Add a TCP or UDP type (I use TCP) and ensure that it's setup for 514 and the sourcetype is syslog (i used cisco_syslog) I hope it helps 🙂 ... View more