Enabling SFTP for forwarding logs

[keerthana_k]

Hi

We have splunk forwarders installed in our web servers which forward logs to our analytics application's forwarder. We need this transfer to happen through SFTP. Is there any way we can configure the forwarders to use SFTP for transferring the log files? Where are we supposed to make changes?

Thanks in advance.

[Ayn · Accepted solution]

Nope, forwarders cannot transfer data using SFTP. The supported ways of forwarding are:

• Forwarding to another Splunk instance using Splunk's own protocol
• Send raw data unencrypted via UDP
• Send raw data unencrypted via TCP
• Send raw data encrypted via TCP using SSL

[keerthana_k]

Is this scenario changed with newer versions of Splunk? I couldn't find any documentation related to it but would like to know if it is possible.

[FrankVl]

That answer is still valid.

Well, it can also send as syslog instead of raw, but that still doesn't get you SFTP.