Universal forwarder deployment prerequisites

Before you can deploy the universal forwarder, see the following universal forwarder prerequisites sections:

• Decide if you want to use the Splunk deployment server
• Computer hardware requirements
• Compatible operating systems

Decide if you want to use the Splunk deployment server

To personalize how data is sent to the indexer, you edit the universal forwarder's configuration files. Through the deployment server, you can edit multiple universal forwarders at once by manually editing a single file. See About deployment server and forwarder management in the Updating Splunk Enterprise Instances manual.

Computer hardware requirements

The universal forwarder has the following minimum processing, RAM, and disk space requirements:

The hardware requirements for universal forwarders appear in the following table:

Note that to support changes to requirements for App Key Value Store, for Intel x86_64, a Sandy Bridge or higher Core processor is required, with the SSE4.2, AVX, and AES-NI instructions enabled. Ensure your system supports Advanced Vector Extensions (AVX). You cannot upgrade to KV store server version 7.0 unless your system supports AVX and you turn it on in your system's CPU settings.

Recommended	Dual-core 1.5GHz+ processor, 1GB+ RAM
Minimum	1.0Ghz processor, 512MB RAM, 5GB of free disk space

Compatible operating systems

For compatible operating systems, see Supported operating systems in the Splunk Enterprise Installation manual.