topic Re: Can someone delineate the advantages/disadvantages of using the universal forwarder vs. the oneshot command? in Getting Data In

Can someone delineate the advantages/disadvantages of using the universal forwarder vs. the oneshot command?

jaredlaney — Tue, 15 Sep 2015 16:00:05 GMT

My team has been thinking about changing to the Splunk CLI oneshot command instead of the Splunk Universal Forwarder configs and traditional monitoring.

Re: Can someone delineate the advantages/disadvantages of using the universal forwarder vs. the oneshot command?

woodcock — Tue, 15 Sep 2015 16:09:38 GMT

So you are contemplating recreating all of the functionality that a forwarder provides by coding it yourself and using the oneshot command and the method of injecting stuff into Splunk? WHY???? That is crazy! I find it difficult to imagine something that you might like to add to a forwarder that you cannot already do using Splunk's own forwarder configuration capabilities. Are you joking or am I misunderstanding you?

Re: Can someone delineate the advantages/disadvantages of using the universal forwarder vs. the oneshot command?

jaredlaney — Tue, 15 Sep 2015 16:20:50 GMT

I'm not but I need reasons to convince my team otherwise.

Re: Can someone delineate the advantages/disadvantages of using the universal forwarder vs. the oneshot command?

jaredlaney — Tue, 15 Sep 2015 16:24:08 GMT

What else does it provide besides buffering, failover, and a round robin load balance (not a true load balance)? That is what I'm trying to explain to them.

Re: Can someone delineate the advantages/disadvantages of using the universal forwarder vs. the oneshot command?

woodcock — Tue, 15 Sep 2015 16:30:50 GMT

Let's see: SSL, multiple destinations, buffering, transforming, timezoning, debugging tools, C&C by Deployment Server, Integration into DMC...

Re: Can someone delineate the advantages/disadvantages of using the universal forwarder vs. the oneshot command?

alacercogitatus — Tue, 15 Sep 2015 16:41:15 GMT

Not to mention Windows event log black/white lists, continuous file monitoring (oneshot would have to be scripted), Windows perfmon/powershell collection natively, etc etc etc.

@jaredlaney, what problem is your team seeing that caused this change of heart? I bet it can be fixed......

Re: Can someone delineate the advantages/disadvantages of using the universal forwarder vs. the oneshot command?

jaredlaney — Tue, 15 Sep 2015 16:44:46 GMT

Thanks for the ammunition. They relented... 🙂

Re: Can someone delineate the advantages/disadvantages of using the universal forwarder vs. the oneshot command?

jaredlaney — Tue, 15 Sep 2015 16:45:49 GMT

Our files are static and we don't do Windows but definitely true.

Re: Can someone delineate the advantages/disadvantages of using the universal forwarder vs. the oneshot command?

jaredlaney — Tue, 15 Sep 2015 16:50:29 GMT

We have static log files that get created once a day and we're looking for a way to verify that the data made it to Splunk. We're thinking that we'd have to query Splunk through the Rest interface to verify that the data made it.

Re: Can someone delineate the advantages/disadvantages of using the universal forwarder vs. the oneshot command?

alacercogitatus — Tue, 15 Sep 2015 16:54:55 GMT

Then, simply put, use the UF. Then in Splunk, write a saved scheduled report that finds that data. If count < 1, then it didn't make it. If it is count > 0, then you are good to go.