Getting Data In

Can the Universal Forwarder send logs to an AWS S3 bucket?

RecoMark0
Path Finder

Hello,
We would like to be able to have our universal forwarders that are installed on AWS instances, to forward logs/indexes to an S3 bucket(instead of an indexer). Our client will then use their own splunk to read them. Is this possible?

We want to avoid just sending all our logs for this client to S3, as we have a lot of different logs, and maintaining an in house script to this would be high. So using splunk is our first choice, but I have been unable to find this feature specifically.

0 Karma
1 Solution

_d_
Splunk Employee
Splunk Employee

The short answer is no. The Universal Forwarder will happily send data to a set of Splunk receivers but not directly to S3.
However, you can chose to retire Splunk data to S3 if you'd like.

View solution in original post

_d_
Splunk Employee
Splunk Employee

The short answer is no. The Universal Forwarder will happily send data to a set of Splunk receivers but not directly to S3.
However, you can chose to retire Splunk data to S3 if you'd like.

View solution in original post

.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!