Good day Splunkers,
Would like to ask some questions on the universal forwarder.
Thanks,
Hi crt89,
basically you can say, that the impact of the universal forwarder is very low. You can see maybe some CPU and IO peak during initial load of old logs. But during daily business the load should stay at a low one numbered percent.
The load will increase, the more file will be observed by the UF.
Regarding the minimum requirements, here is a basic rule - if you depend on near real-time events use fast CPU's and high IO disks. If you don't ... well, I run an UF on an ARMv5te 1.2Ghz mini server with an old 2.5" USB2 disk attached and it runs fine.
To sum this up: it really depends on your use case, if you need special fast CPU and high IO disks or not.
You can also check the system requirement docs and get some CPU info's for the UF.
hope this helps ...
cheers, MuS
Hi crt89,
basically you can say, that the impact of the universal forwarder is very low. You can see maybe some CPU and IO peak during initial load of old logs. But during daily business the load should stay at a low one numbered percent.
The load will increase, the more file will be observed by the UF.
Regarding the minimum requirements, here is a basic rule - if you depend on near real-time events use fast CPU's and high IO disks. If you don't ... well, I run an UF on an ARMv5te 1.2Ghz mini server with an old 2.5" USB2 disk attached and it runs fine.
To sum this up: it really depends on your use case, if you need special fast CPU and high IO disks or not.
You can also check the system requirement docs and get some CPU info's for the UF.
hope this helps ...
cheers, MuS