Deployment Architecture

Can Splunk Universal Forwarder Forward the Data to Splunk Enterprise using UDP protocol?

Shamnad
Observer

We have a deployment scenario where Splunk UF forwards the Data to Splunk Enterprise using "One Way Communication", so is there any way we can have the Splunk UF Communicates with the Splunk UE through UDP Protocol?

Labels (1)
0 Karma

Shamnad
Observer

Our scenario is like we are having multiple Universal Forwarders forwarding data to Splunk Enterprise through One Way, in between the UF's and Splunk Enterprise there is a Proxy server which carries the TCP packets from Multiple UF's and the Splunk Enterprise. When the data reaches the Enterprise it will shows the host IP of the Proxy Server address, so all the forwarded events will be treated as the events from the Proxy server, is there any way we can get the host details/IP address of each sources(UF's).

0 Karma

thambisetty
Super Champion

you can have TCP also to have one way communication. meaning connection will be always initiated by Universal forwarder. you need to open a firewall rule src to dest on port 9997 ( default).

I don't think you can forward over UDP to Splunk Enterprise from Splunk Universal forwarder. you need to have syslog installed on Splunk Enterprise server for that.

————————————
If this helps, give a like below.
0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.