Solved: Re: splunk Universal forwarder

iherb_0718 · ‎04-13-2021

Is the data that is sent from a splunk Universal Forwarder to the heavy forwarder, syslog messages? If so, how do I find out which format it is using (ie: syslog-ng)

scelikok · ‎04-13-2021

Hi @iherb_0718,

Splunk instances data communication is called S2S (Splunk to Splunk) are proprietary TCP communications. They are not syslog.

If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

scelikok · ‎04-13-2021

Hi @iherb_0718,

Splunk instances data communication is called S2S (Splunk to Splunk) are proprietary TCP communications. They are not syslog.

If this reply helps you an upvote and "Accept as Solution" is appreciated.

splunk Universal forwarder

configuration

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Automating Threat Operations and Threat Hunting with Recorded Future

Join the Conversation