can we send our Linux logs to intermediate UF directly (syslog i mean, like Cisco switches) without installing UF and TA on Linux ?

[haddad]

hi all
We have some Linux servers and we need to send the logs from these servers to Splunk.
Should we install UF and TA on linux servers or not ?

can we directly send logs to intermediate forwarder ?

[FrankVl]

It depends a bit on how you have these logs on those linux servers. If that is all syslog based, you should be able to configure the syslog daemon on these linux servers to forward data to your intermediate forwarders (by setting up a TCP/UDP network input on those).

But that is typically not recommended. The recommended approach is to wherever possible install a UF on the source, as that significantly improves reliability, configurability etc. of the data collection.