Getting Data In

Questions on a Splunk Forwarder

crt89
Communicator

Good day Splunkers,

Would like to ask some questions on the universal forwarder.

  1. What is the minimum CPU usage? Given that we configured the forwarder as default with a minimum of 3 log files being monitored and forwarded.
  2. What is its disk I/O requirements?

Thanks,

0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi crt89,

basically you can say, that the impact of the universal forwarder is very low. You can see maybe some CPU and IO peak during initial load of old logs. But during daily business the load should stay at a low one numbered percent.

The load will increase, the more file will be observed by the UF.

Regarding the minimum requirements, here is a basic rule - if you depend on near real-time events use fast CPU's and high IO disks. If you don't ... well, I run an UF on an ARMv5te 1.2Ghz mini server with an old 2.5" USB2 disk attached and it runs fine.

To sum this up: it really depends on your use case, if you need special fast CPU and high IO disks or not.

You can also check the system requirement docs and get some CPU info's for the UF.

hope this helps ...

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi crt89,

basically you can say, that the impact of the universal forwarder is very low. You can see maybe some CPU and IO peak during initial load of old logs. But during daily business the load should stay at a low one numbered percent.

The load will increase, the more file will be observed by the UF.

Regarding the minimum requirements, here is a basic rule - if you depend on near real-time events use fast CPU's and high IO disks. If you don't ... well, I run an UF on an ARMv5te 1.2Ghz mini server with an old 2.5" USB2 disk attached and it runs fine.

To sum this up: it really depends on your use case, if you need special fast CPU and high IO disks or not.

You can also check the system requirement docs and get some CPU info's for the UF.

hope this helps ...

cheers, MuS

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...