Universal forwarder

The Splunk universal forwarder is a no-license-required app that is not unique to Splunk Cloud or even new to Splunk 7.0; in fact, it has been available and in use for quite some time and several releases.

Since it's a cloud-specific app, we'll not spend much time on it here. But, as a reminder, UF is a dedicated, lightweight form of Splunk Enterprise containing only the vital components required to forward data and is intended to run on production servers, requiring minimal CPU and memory. It has the slightest effect possible on other software, making it ideal for Splunk Cloud.

Get Implementing Splunk 7 - Third Edition now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.