On a UF, splunkd memory usage increases as the number of inputs increases. Here is another question that gives some good advice about how to reduce memory usage.
Limit the memory used by the universal forwarder
In my own experience, without tuning, the UF uses about 40 MB of memory in general. When monitoring 2000 files, the UF uses about 50 MB of memory. In the past, I've seen the UF get very slow, with high memory and CPU usage, when monitoring over 5000 files.
I often find that people do not realize how many files Splunk is monitoring. Every file that is monitored, even if it is not being updated with new data, takes some resources. On the UF, run splunk list monitor to see exactly what Splunk is monitoring. Sometimes you can dramatically improve UF performance simply by moving older files to an directory that is not being monitored by the UF.
... View more