To personalize how data is sent to the indexer, you edit the universal forwarder's configuration files. Through the deployment server, you can edit multiple universal forwarders at once by manually editing a single file. See About deployment server and forwarder management in the Updating Splunk Enterprise Instances manual.

The universal forwarder has the following minimum processing, RAM, and disk space requirements:

The hardware requirements for universal forwarders appear in the following table:

Note that to support changes to requirements for App Key Value Store, for Intel x86_64, a Sandy Bridge or higher Core processor is required, with the SSE4.2, AVX, and AES-NI instructions enabled. Ensure your system supports Advanced Vector Extensions (AVX). You cannot upgrade to KV store server version 7.0 unless your system supports AVX and you turn it on in your system's CPU settings.

For compatible operating systems, see Supported operating systems in the Splunk Enterprise Installation manual.