To personalize how data is sent to the indexer, you edit the universal forwarder's configuration files. Through the deployment server, you can edit multiple universal forwarders at once by manually editing a single file. See About deployment server and forwarder management in the Updating Splunk Enterprise Instances manual.

The universal forwarder has the following minimum processing, RAM, and disk space requirements:

The hardware requirements for universal forwarders appear in the following table:

For compatible operating systems, see Supported operating systems in the Splunk Enterprise Installation manual.