Splunk® Enterprise

Forwarding Data

Acrobat logo Download manual as PDF

Splunk Enterprise version 6.x is no longer supported as of October 23, 2019. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Acrobat logo Download topic as PDF

System requirements

This topic discusses the system requirements for using a universal forwarder and any deployment considerations you should make when you deploy it.

Platform and hardware requirements =

The universal forwarder supports the same operating systems that full Splunk Enterprise supports. See the list in the Installation manual.

The hardware requirements for universal forwarders are as follows:

Recommended Dual-core 1.5GHz+ processor, 1GB+ RAM
Minimum 1.0Ghz processor, 512MB RAM

Licensing requirements

The universal forwarder ships with a pre-installed license. See "Types of Splunk Enterprise licenses" in the Admin manual for details.

Other requirements

Sun SPARC systems

If you plan to install a universal forwarder on a Sun SPARC system that runs Solaris, confirm that you have patch level SUNW_1.22.7 or later of the C library (libc.so.1). If you do not, the universal forwarder cannot run because it needs this version of the library.

User rights

You must have admin or equivalent rights on the machine where you're installing the universal forwarder.

Forwarders and indexer clusters

When using forwarders to send data to peer nodes in an indexer cluster, you deploy and configure them a bit differently from the description in this topic. To learn more about forwarders and clusters, read "Use forwarders to get your data" in the Managing Indexers and Clusters of Indexers manual.

Indexer and universal forwarder compatibility

See "Compatibility between forwarders and indexers" for details.

Last modified on 06 August, 2015
The universal forwarder
Forwarder deployment topologies

This documentation applies to the following versions of Splunk® Enterprise: 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.3.14, 6.4.0

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters