This topic discusses the system requirements for using a universal forwarder and any deployment considerations you should make when you deploy it.
Platform and hardware requirements =
The universal forwarder supports the same operating systems that full Splunk Enterprise supports. See the list in the Installation manual.
The hardware requirements for universal forwarders are as follows:
|Recommended||Dual-core 1.5GHz+ processor, 1GB+ RAM|
|Minimum||1.0Ghz processor, 512MB RAM|
The universal forwarder ships with a pre-installed license. See "Types of Splunk Enterprise licenses" in the Admin manual for details.
Sun SPARC systems
If you plan to install a universal forwarder on a Sun SPARC system that runs Solaris, confirm that you have patch level
SUNW_1.22.7 or later of the C library (
libc.so.1). If you do not, the universal forwarder cannot run because it needs this version of the library.
You must have admin or equivalent rights on the machine where you're installing the universal forwarder.
Forwarders and indexer clusters
When using forwarders to send data to peer nodes in an indexer cluster, you deploy and configure them a bit differently from the description in this topic. To learn more about forwarders and clusters, read "Use forwarders to get your data" in the Managing Indexers and Clusters of Indexers manual.
Indexer and universal forwarder compatibility
See "Compatibility between forwarders and indexers" for details.
The universal forwarder
Forwarder deployment topologies
This documentation applies to the following versions of Splunk® Enterprise: 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.3.14, 6.4.0