It truly depends on many factors, like number of events, number of forwarders, as well as stakeholder expectations/requirements, and how much time and money you have!
https://www.aplura.com/splunk-best-practices/#hardware
The blog post how's you the bandwidth usage difference between universal and heavy forwarders.
Universal or Heavy, that is the question? | Splunk
The general answer is it depends, however you can refer to
https://answers.splunk.com/answers/2014/what-is-the-minimum-network-bandwidth-required-for-splunk-fo... OR https://answers.splunk.com/answers/340084/how-to-search-how-much-bandwidth-a-forwarder-is-us.html
It truly depends on many factors, like number of events, number of forwarders, as well as stakeholder expectations/requirements, and how much time and money you have!
https://www.aplura.com/splunk-best-practices/#hardware
The blog post how's you the bandwidth usage difference between universal and heavy forwarders.
Universal or Heavy, that is the question? | Splunk
The general answer is it depends, however you can refer to
https://answers.splunk.com/answers/2014/what-is-the-minimum-network-bandwidth-required-for-splunk-fo... OR https://answers.splunk.com/answers/340084/how-to-search-how-much-bandwidth-a-forwarder-is-us.html