Getting Data In

What is S2S Protocol Specification?

florianhh
Explorer

Good Morning,

I’m looking for the specification of the S2S protocol.

We have some trouble with getting splunk uf data through a Palo Alto Firewall. 
the firewall has a Application Profile Engine.

So it not just looks at layer 4 for IP/Port and Protocol but also certain Aspekts of the packet like headers….

There is no predefined profile for splunk S2S so we need to create it, but I can‘t find the docs for Protocol definition. 
We are aware of the fact that it is possible to bypass this App engine and do a layer 4 filtering.

But it would be the only application in the company to do that and the fact that it would be for a Internet facing service and a security service seams  off. 🫣

We where adviced to use S2S over HEC for Stability reasons if it does not work out we have to switch but for now we want to try make it work. 

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The Splunk-to-Splunk protocol is proprietary.  There are no public documents about it.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...