Community:What is splunks footprint

From Splunk Wiki

Jump to: navigation, search

What is Splunk's footprint?

I need to know because I'm currently planning capacity requirements for my Splunk rollout

If you're asking this question, you probably want to read this:


Also, for general discussions of footprint and forwarder footprint see:


Otherwise, it depends, right?

But seriously, folks. More to come here. Please contribute your thoughts under the topics below regarding the footprint of memory, CPU, network, disk i/o, etc.

Splunk Indexer

Splunk Forwarder

Splunk Lightweight Forwarder (LWF)

Regarding Splunk memory footprint, light forwarders used around 35-38MB on start, possibly growing towards 50MB on indexer backup. A full forwarder's memory use is going to vary fairly heavily on event size. Other characteristics like CPU are much harder to quantify because they vary heavily upon data volume, data type, processing applied, and so on.

  • Note*: This doesn't apply to the dedicated forwarder package, due to be released around 4.2

330MB binary 50MB in-memory The thruput is throttled in limits.conf to 256Kbps. In practice, this means 1% CPU

Personal tools
Hot Wiki Topics

About Splunk >
  • Search and navigate IT data from applications, servers and network devices in real-time.
  • Download Splunk