Getting Data In

Can Universal Forwarder with SSL compression enabled fall back to normal forwarding if SSL is not working.

knene
New Member

Hello in our environment we are already using UF on 15K servers, but they are sending logs to Indexer cluster on default port and without any compression.

We now need to enable SSL compression on them to save bandwidth. For this we would be using different port than default one.

But what i need to know is if we enable ssl compression in outputs.conf of all servers what will happen where server does not have connectivity to indexers on that port.  will it break logs being sent to indexer or will it fall back to sending uncompressed data on default port?

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...