System requirements

This topic discusses the system requirements for using a universal forwarder and any deployment considerations you should make when you deploy it.

Platform and hardware requirements =

The universal forwarder supports the same operating systems that full Splunk Enterprise supports. See the list in the Installation manual.

The hardware requirements for universal forwarders are as follows:

Recommended	Dual-core 1.5GHz+ processor, 1GB+ RAM
Minimum	1.0Ghz processor, 512MB RAM

Licensing requirements

The universal forwarder ships with a pre-installed license. See "Types of Splunk Enterprise licenses" in the Admin manual for details.

Other requirements

Sun SPARC systems

If you plan to install a universal forwarder on a Sun SPARC system that runs Solaris, confirm that you have patch level SUNW_1.22.7 or later of the C library (libc.so.1). If you do not, the universal forwarder cannot run because it needs this version of the library.

User rights

You must have admin or equivalent rights on the machine where you're installing the universal forwarder.

Forwarders and indexer clusters

When using forwarders to send data to peer nodes in an indexer cluster, you deploy and configure them a bit differently from the description in this topic. To learn more about forwarders and clusters, read "Use forwarders to get your data" in the Managing Indexers and Clusters of Indexers manual.

Indexer and universal forwarder compatibility

See "Compatibility between forwarders and indexers" for details.