Splunk® Universal Forwarder

Forwarder Manual

This documentation does not apply to the most recent version of Splunk® Universal Forwarder. For documentation on the most recent version, go to the latest release.

Universal forwarder system requirements

The system requirements for a universal forwarder are different than those for a heavy or light forwarder. To learn about system requirements for heavy and light forwarders, see System requirements in the Splunk Enterprise Installation Manual.

Platform and hardware requirements

For details about the platforms where you can install the universal forwarder, see Supported Operating Systems in the Splunk Enterprise Installation Manual.

The hardware requirements for universal forwarders appear in the following table:

Recommended Dual-core 1.5GHz+ processor, 1GB+ RAM
Minimum 1.0Ghz processor, 512MB RAM, 5GB of free disk space

Licensing requirements

The universal forwarder ships with its own license. See Types of Splunk software licenses in the Admin Manual for details.

Other requirements

Sun SPARC systems

Before you install a universal forwarder on a Sun SPARC system that runs Solaris, confirm that you have patch level SUNW_1.22.7 or later of the C library (libc.so.1). The universal forwarder needs this version of the library to run on Solaris for SPARC architecture.

User rights

To perform the installation of the universal forwarder, you must have administrator or equivalent rights.

To use the forwarder, you do not need elevated privileges, but the user that the forwarder runs as must have read access to the resources that you want to monitor and forward.

Forwarders and Splunk Enterprise indexer clusters

When you use forwarders to send data to peer nodes in a Splunk Enterprise indexer cluster, there are installation requirements that diverge from the specifications shown in this topic. To learn more about forwarders and clusters, see Use forwarders to get data into the indexer in Managing Indexers and Clusters of Indexers.

Splunk Enterprise/universal forwarder version compatibility

Many versions of universal forwarder and indexer are compatible with one another. See Compatibility between forwarders and Splunk Enterprise indexers for details on the versions of forwarder that work with a specific version of indexer.

Last modified on 01 December, 2021
About forwarding and receiving data   Example forwarder deployment topologies

This documentation applies to the following versions of Splunk® Universal Forwarder: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10, 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.1.6, 8.1.7, 8.1.8, 8.1.9, 8.1.10, 8.1.11, 8.1.12, 8.1.13, 8.1.14, 8.2.0, 8.2.1, 8.2.2, 8.2.3


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters