Your data may come from a number of sources; these can be files, network ports, or scripts. Let's walk through a few common scenarios.
Monitoring logs on servers
In this scenario, servers write their logs to a local drive, and a forwarder process monitors these logs. This is the typical Splunk installation.
The advantages of this approach include:
- This process is highly optimized. If the indexers are not overworked, events are usually searchable within a few seconds.
- Slowdowns caused by network problems or indexer overload are handled gracefully. The forwarder process will pick up where it left off when the slowdown is resolved.
- The agent is light, typically using less than 100 megabytes of RAM and a few percent of one CPU. These ...