There is no need to deploy Splunk on a production system if it is already configured, for example network logging via syslog. If you install Splunk on a production system to read the log files locally, the CPU and network hogs are comparable to tailing the same file and piping the output to netcat. Become. The memory footprint of the Splunk Universal Forwarder for tailing files and forwarding them to the network is around 100MB of resident memory depending on the number of files referenced.