https://community.splunk.com/t5/Getting-Data-In/Can-Universal-Forwarder-with-SSL-compression-enabled-fall-back/m-p/559083#M92490 <P>Hello in our environment we are already using UF on 15K servers, but they are sending logs to Indexer cluster on default port and without any compression.</P><P>We now need to enable SSL compression on them to save bandwidth. For this we would be using different port than default one.</P><P>But what i need to know is if we enable ssl compression in outputs.conf of all servers what will happen where server does not have connectivity to indexers on that port.&nbsp; will it break logs being sent to indexer or will it fall back to sending uncompressed data on default port?</P> Mon, 12 Jul 2021 13:03:04 GMT knene 2021-07-12T13:03:04Z https://community.splunk.com/t5/Getting-Data-In/Can-Universal-Forwarder-with-SSL-compression-enabled-fall-back/m-p/559083#M92490 <P>Hello in our environment we are already using UF on 15K servers, but they are sending logs to Indexer cluster on default port and without any compression.</P><P>We now need to enable SSL compression on them to save bandwidth. For this we would be using different port than default one.</P><P>But what i need to know is if we enable ssl compression in outputs.conf of all servers what will happen where server does not have connectivity to indexers on that port.&nbsp; will it break logs being sent to indexer or will it fall back to sending uncompressed data on default port?</P> Mon, 12 Jul 2021 13:03:04 GMT https://community.splunk.com/t5/Getting-Data-In/Can-Universal-Forwarder-with-SSL-compression-enabled-fall-back/m-p/559083#M92490 knene 2021-07-12T13:03:04Z