splunk add forward-server IP:PORT -auth user:pass - For UDP ???

[grillotron]

Hi,

Please i need to use de UDP protocol to add Forwarders (Universal in my case) buy supoust its de same command working with another options of "forwarders"..

splunk add forward-server IP:PORT -auth user:pass

¿what is de sintaxis?

thanks

[grillotron]

Hi,

I don't need to use UDP ... it's only to keep the same way UDP/514. But really... i don't need it - i will create a recibe data port tcp/514.

thanks

[Ayn]

No, forwarding from a Splunk instance to another cannot use UDP. Why would you need UDP?

If you really can't do this via TCP, you'll have to resort to sending syslog over UDP from the forwarder to the indexer.

[Ayn]

Righty. By the way, the best thing would be to use Splunk's own protocol for forwarding events from one Splunk instance to another (splunktcp) rather than just sending the raw data (tcp).

[grillotron]

Hi,

I don't need to use UDP ... it's only to keep the same way UDP/514. But really... i don't need it - i will create a recibe data port tcp/514.

thanks

[kristian_kolb]

and that would not be a good idea, since you'd then be limited to standard syslog limits (<1k message size, single line). Try to fit a stacktrace, or eventlog message into that... 🙂