All,
I have a couple small use cases where a full install of Splunk with the GUI disabled might be better than using a Universal Forwarder. And honestly, just curious.
1) Mainly some props manipulation/transforms I want to offload off my existing heavy forwarder tier since I am hardware strapped for Splunk. But the customer has surplus resources left and right.
2) And maybe some scripted actions on the server itself, not sure about that just curious
Has anyone ever done this?
Anything obvious silly there I am missing?
Has anyone compared the base UF vs base Full install overhead for a simple inputs.conf?
thanks
↧