Community:What is splunks footprint
From Splunk Wiki
What is Splunk's footprint?
I need to know because I'm currently planning capacity requirements for my Splunk rollout
If you're asking this question, you probably want to read this:
Also, for general discussions of footprint and forwarder footprint see:
* http://www.splunk.com/wiki/Deploy:ForwarderBestPractice * http://www.splunk.com/wiki/Community:MinimizingForwarderFootprint
Otherwise, it depends, right?
But seriously, folks. More to come here. Please contribute your thoughts under the topics below regarding the footprint of memory, CPU, network, disk i/o, etc.
Splunk Lightweight Forwarder (LWF)
Regarding Splunk memory footprint, light forwarders used around 35-38MB on start, possibly growing towards 50MB on indexer backup. A full forwarder's memory use is going to vary fairly heavily on event size. Other characteristics like CPU are much harder to quantify because they vary heavily upon data volume, data type, processing applied, and so on.
- Note*: This doesn't apply to the dedicated forwarder package, due to be released around 4.2
330MB binary 50MB in-memory The thruput is throttled in limits.conf to 256Kbps. In practice, this means 1% CPU