From Splunk Wiki

What is Splunk's footprint?

I need to know because I'm currently planning capacity requirements for my Splunk rollout

If you're asking this question, you probably want to read this:

  * http://www.splunk.com/wiki/Community:Planning_your_Splunk_deployment

Also, for general discussions of footprint and forwarder footprint see:

  * http://www.splunk.com/wiki/Deploy:ForwarderBestPractice
  * http://www.splunk.com/wiki/Community:MinimizingForwarderFootprint

Otherwise, it depends, right?

But seriously, folks. More to come here. Please contribute your thoughts under the topics below regarding the footprint of memory, CPU, network, disk i/o, etc.

Splunk Indexer

Splunk Forwarder

Splunk Lightweight Forwarder (LWF)

Regarding Splunk memory footprint, light forwarders used around 35-38MB on start, possibly growing towards 50MB on indexer backup. A full forwarder's memory use is going to vary fairly heavily on event size. Other characteristics like CPU are much harder to quantify because they vary heavily upon data volume, data type, processing applied, and so on.

• Note*: This doesn't apply to the dedicated forwarder package, due to be released around 4.2

330MB binary 50MB in-memory The thruput is throttled in limits.conf to 256Kbps. In practice, this means 1% CPU