Solved: splunk Universal forwarder

iherb_0718 · ‎04-13-2021

Is the data that is sent from a splunk Universal Forwarder to the heavy forwarder, syslog messages? If so, how do I find out which format it is using (ie: syslog-ng)

scelikok · ‎04-13-2021

Hi @iherb_0718,

Splunk instances data communication is called S2S (Splunk to Splunk) are proprietary TCP communications. They are not syslog.

If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

scelikok · ‎04-13-2021

Hi @iherb_0718,

Splunk instances data communication is called S2S (Splunk to Splunk) are proprietary TCP communications. They are not syslog.

If this reply helps you an upvote and "Accept as Solution" is appreciated.

splunk Universal forwarder

configuration

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Agentic Operations Start with Context: Build the Right Data Foundation

Assisted, Augmented or Agentic? Choose Your Splunk Starting Point

Session 2 | Beyond the Thread: Operationalizing AI with Confidence

Join the Conversation