Getting Data In

Is it possible to receive and forward logs using a Splunk universal forwarder on Linux?

Builder

Can you please help us?

Is it possible to receive and forward logs using a Splunk universal forwarder? Because logs are coming from secure network and not allowed to access internet, we have installed the forwarder on a host that has access to internet and is getting logs using rsync, then forwarding to Splunk farm. However, it's consuming more storage on the forwarder node side. To avoid that, is there a way to receive and forward using a universal forwarder on Linux?

0 Karma
1 Solution

Splunk Employee
Splunk Employee

You could have the forwarder listen on a particular port for syslog traffic (usually port 514) which could then be forwarded using the normal forwarder behaviour.

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

You could have the forwarder listen on a particular port for syslog traffic (usually port 514) which could then be forwarded using the normal forwarder behaviour.

View solution in original post

0 Karma

Builder

i tested and its working fine. thank you!.

0 Karma