topic Re: UFs don't parse data, but docs say splunktcp-ssl is only for "parsed" data to indexers? in Getting Data In

Why don't UFs parse data when docs say splunktcp-ssl is only for "parsed" data to indexers?

dokaas_2 — Mon, 27 Feb 2023 21:11:52 GMT

According to the Splunk documentation on the attribute [splunktcp-ssl:<port>] it states that:

* Use this stanza type if you are receiving encrypted, parsed data from a forwarder."

UFs cook, but do not 'parse' the data. Thus, is this effective to send encrypted data from the UF to indexers?

Re: UFs don't parse data, but docs say splunktcp-ssl is only for "parsed" data to indexers?

richgalloway — Mon, 27 Feb 2023 20:52:32 GMT

I think this may be a place where the documentation needs improvement. Splunk Cloud uses SSL exclusively with UFs so you should be able to, also.

Re: UFs don't parse data, but docs say splunktcp-ssl is only for "parsed" data to indexers?

ChrisG — Mon, 27 Feb 2023 21:35:59 GMT

Please submit feedback using the form at the bottom of the documentation page you are looking at. That creates a ticket for the doc team and we will follow up, thank you!