#Splunk forwarder software#

The only reason Universal Forwarder may consume significant resources (4gb+ memory) is when thousands of files are being configured to ingest.

#Splunk forwarder software#

While nothing is impossible in the complex world of IT, I can confidently say that Splunk Universal Forwarder is one of the most efficient software you will find out there. They are skeptical that Universal Forwarder will take down their server, or perhaps take up all the resources and leave nothing for their applications. Note: One major complaint you may get from application owners is about the resource utilization of Splunk Universal Forwarders. It is very light weight and designed to run on production systems. The Splunk Universal Forwarder binary is somewhat similar to that of Splunk Indexer or Search Head, but it is stripped down bare-bone version. Examples include application servers, web servers, directory servers and so on. Universal Forwarders are typically installed on the machines where the source data resides. At the indexers, the data is broken in to Events and indexed for searching. The basic yet the crucial task that Universal Forwarders perform is to collect and send the data to other Splunk processes, typically to the Splunk Indexers. So, What does the Universal Forwarder do Anyway?

There are two types of Splunk forwarders, namely Universal Forwarder and Heavy Forwarder. The other ways of getting data in, sorted by the popularity, based strictly on my experience: While there are many ways to get data into Splunk platform, Splunk Universal Forwarder is by far the most common way to get data in. Figure 1 shows a super high level architecture of Splunk platform: It is one of the core components of Splunk platform, the others being Splunk indexer and Splunk search head. What is a Splunk Forwarder?Ī Splunk forwarder reads data from a data source and forwards to another Splunk or Non-Splunk process. In this post, I’ll explain the difference and suggest when to use certain type of forwarder.

One of the most frequently asked questions in Splunk is the difference between universal forwarder and heavy forwarder.