Getting Data In
Highlighted

Can someone delineate the advantages/disadvantages of using the universal forwarder vs. the oneshot command?

Contributor

My team has been thinking about changing to the Splunk CLI oneshot command instead of the Splunk Universal Forwarder configs and traditional monitoring.

0 Karma
Highlighted

Re: Can someone delineate the advantages/disadvantages of using the universal forwarder vs. the oneshot command?

Esteemed Legend

So you are contemplating recreating all of the functionality that a forwarder provides by coding it yourself and using the oneshot command and the method of injecting stuff into Splunk? WHY???? That is crazy! I find it difficult to imagine something that you might like to add to a forwarder that you cannot already do using Splunk's own forwarder configuration capabilities. Are you joking or am I misunderstanding you?

View solution in original post

Highlighted

Re: Can someone delineate the advantages/disadvantages of using the universal forwarder vs. the oneshot command?

Contributor

I'm not but I need reasons to convince my team otherwise.

0 Karma
Highlighted

Re: Can someone delineate the advantages/disadvantages of using the universal forwarder vs. the oneshot command?

Contributor

What else does it provide besides buffering, failover, and a round robin load balance (not a true load balance)? That is what I'm trying to explain to them.

0 Karma
Highlighted

Re: Can someone delineate the advantages/disadvantages of using the universal forwarder vs. the oneshot command?

Esteemed Legend

Let's see: SSL, multiple destinations, buffering, transforming, timezoning, debugging tools, C&C by Deployment Server, Integration into DMC...

0 Karma
Highlighted

Re: Can someone delineate the advantages/disadvantages of using the universal forwarder vs. the oneshot command?

SplunkTrust
SplunkTrust

Not to mention Windows event log black/white lists, continuous file monitoring (oneshot would have to be scripted), Windows perfmon/powershell collection natively, etc etc etc.

@jaredlaney, what problem is your team seeing that caused this change of heart? I bet it can be fixed......

0 Karma
Highlighted

Re: Can someone delineate the advantages/disadvantages of using the universal forwarder vs. the oneshot command?

Contributor

Our files are static and we don't do Windows but definitely true.

0 Karma
Highlighted

Re: Can someone delineate the advantages/disadvantages of using the universal forwarder vs. the oneshot command?

Contributor

We have static log files that get created once a day and we're looking for a way to verify that the data made it to Splunk. We're thinking that we'd have to query Splunk through the Rest interface to verify that the data made it.

0 Karma
Highlighted

Re: Can someone delineate the advantages/disadvantages of using the universal forwarder vs. the oneshot command?

SplunkTrust
SplunkTrust

Then, simply put, use the UF. Then in Splunk, write a saved scheduled report that finds that data. If count < 1, then it didn't make it. If it is count > 0, then you are good to go.

0 Karma
Highlighted

Re: Can someone delineate the advantages/disadvantages of using the universal forwarder vs. the oneshot command?

Contributor

Thanks for the ammunition. They relented... 🙂

0 Karma