Is it possible to receive and forward logs using a Splunk universal forwarder on Linux?

[dhavamanis]

Can you please help us?

Is it possible to receive and forward logs using a Splunk universal forwarder? Because logs are coming from secure network and not allowed to access internet, we have installed the forwarder on a host that has access to internet and is getting logs using rsync, then forwarding to Splunk farm. However, it's consuming more storage on the forwarder node side. To avoid that, is there a way to receive and forward using a universal forwarder on Linux?

[sduff_splunk · Accepted solution]

You could have the forwarder listen on a particular port for syslog traffic (usually port 514) which could then be forwarded using the normal forwarder behaviour.

[dhavamanis]

i tested and its working fine. thank you!.