Monitoring Splunk

Can I make my LWF (lightwieght forwarder) even MORE lightweight that it is out-of-the-box (i.e. Super LightWeight)?

maverick
Splunk Employee
Splunk Employee

If so, how? What else can I disable or streamline such that my LWF takes up even less local resources?

yannK
Splunk Employee
Splunk Employee

another tracks : - if you are on 4.2, try the 4.2 Universalforwarder, that is minimalistic. - be very specific in your path to monitor to reduce the number of path to check. (event before using white or blacklisting)

jbsplunk
Splunk Employee
Splunk Employee

This was discussed here and some pretty good information as given out:

http://answers.splunk.com/questions/10044/reducing-a-light-forwarders-footprint-using-a-config-file

gfriedmann
Communicator

If it is windows light forwarder, you can also specifically disable the scripted inputs for wmi and regmon in system/default. This will remove two extra processes, but splunkd is still the heavy.

ziegfried
Influencer

Just a minor improvement, but you can disable (or delete) the sample app.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...