Universal forwarder system requirements
The system requirements for a universal forwarder are different than those for a heavy or light forwarder. To learn about system requirements for heavy and light forwarders, see System requirements in the Splunk Enterprise Installation Manual.
Platform and hardware requirements
For details about the platforms where you can install the universal forwarder, see Supported Operating Systems in the Splunk Enterprise Installation Manual.
The hardware requirements for universal forwarders appear in the following table:
| Recommended | Dual-core 1.5GHz+ processor, 1GB+ RAM |
| Minimum | 1.0Ghz processor, 512MB RAM, 5GB of free disk space |
Licensing requirements
The universal forwarder ships with its own license. See Types of Splunk software licenses in the Admin Manual for details.
Other requirements
Sun SPARC systems
Before you install a universal forwarder on a Sun SPARC system that runs Solaris, confirm that you have patch level SUNW_1.22.7 or later of the C library (libc.so.1). The universal forwarder needs this version of the library to run on Solaris for SPARC architecture.
User rights
To perform the installation of the universal forwarder, you must have administrator or equivalent rights.
To use the forwarder, you do not need elevated privileges, but the user that the forwarder runs as must have read access to the resources that you want to monitor and forward.
Forwarders and Splunk Enterprise indexer clusters
When you use forwarders to send data to peer nodes in a Splunk Enterprise indexer cluster, there are installation requirements that diverge from the specifications shown in this topic. To learn more about forwarders and clusters, see Use forwarders to get data into the indexer in Managing Indexers and Clusters of Indexers.
Splunk Enterprise/universal forwarder version compatibility
Many versions of universal forwarder and indexer are compatible with one another. See Compatibility between forwarders and Splunk Enterprise indexers for details on the versions of forwarder that work with a specific version of indexer.
| About forwarding and receiving data | Example forwarder deployment topologies |
This documentation applies to the following versions of Splunk® Universal Forwarder: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10, 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.1.6, 8.1.7, 8.1.8, 8.1.9, 8.1.10, 8.1.11, 8.1.12, 8.1.13, 8.1.14, 8.2.0, 8.2.1, 8.2.2, 8.2.3
Download manual
Feedback submitted, thanks!