https://community.splunk.com/t5/Getting-Data-In/SC4S-and-Universal-Forwarders/m-p/579204#M102257 <P>UFs cannot send to SC4S.&nbsp; They should send directly to your Splunk indexers, typically port 9997.</P> Thu, 23 Dec 2021 19:42:59 GMT richgalloway 2021-12-23T19:42:59Z https://community.splunk.com/t5/Getting-Data-In/SC4S-and-Universal-Forwarders/m-p/579203#M102256 <P>Hello,</P><P>I am new to Splunk and working on getting our environment setup correctly.&nbsp; &nbsp;I have a SC4S server setup and working.&nbsp; My question is about UF installed on Windows servers and Windows AD servers.&nbsp; &nbsp;Should the UF be setup to send info to the SC4S server or should they send them directly to the Splunk Indexer?</P><P>Thanks,</P> Thu, 23 Dec 2021 19:07:57 GMT https://community.splunk.com/t5/Getting-Data-In/SC4S-and-Universal-Forwarders/m-p/579203#M102256 njusticesnb 2021-12-23T19:07:57Z https://community.splunk.com/t5/Getting-Data-In/SC4S-and-Universal-Forwarders/m-p/579204#M102257 <P>UFs cannot send to SC4S.&nbsp; They should send directly to your Splunk indexers, typically port 9997.</P> Thu, 23 Dec 2021 19:42:59 GMT https://community.splunk.com/t5/Getting-Data-In/SC4S-and-Universal-Forwarders/m-p/579204#M102257 richgalloway 2021-12-23T19:42:59Z