Getting Data In

Can the Universal Forwarder send logs to an AWS S3 bucket?

RecoMark0
Path Finder

Hello,
We would like to be able to have our universal forwarders that are installed on AWS instances, to forward logs/indexes to an S3 bucket(instead of an indexer). Our client will then use their own splunk to read them. Is this possible?

We want to avoid just sending all our logs for this client to S3, as we have a lot of different logs, and maintaining an in house script to this would be high. So using splunk is our first choice, but I have been unable to find this feature specifically.

0 Karma
1 Solution

_d_
Splunk Employee
Splunk Employee

The short answer is no. The Universal Forwarder will happily send data to a set of Splunk receivers but not directly to S3.
However, you can chose to retire Splunk data to S3 if you'd like.

View solution in original post

_d_
Splunk Employee
Splunk Employee

The short answer is no. The Universal Forwarder will happily send data to a set of Splunk receivers but not directly to S3.
However, you can chose to retire Splunk data to S3 if you'd like.

View solution in original post

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!