Solved: Re: splunk Universal forwarder

iherb_0718 · ‎04-13-2021

Is the data that is sent from a splunk Universal Forwarder to the heavy forwarder, syslog messages? If so, how do I find out which format it is using (ie: syslog-ng)

scelikok · ‎04-13-2021

Hi @iherb_0718,

Splunk instances data communication is called S2S (Splunk to Splunk) are proprietary TCP communications. They are not syslog.

If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

scelikok · ‎04-13-2021

Hi @iherb_0718,

Splunk instances data communication is called S2S (Splunk to Splunk) are proprietary TCP communications. They are not syslog.

If this reply helps you an upvote and "Accept as Solution" is appreciated.

splunk Universal forwarder

configuration

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

All Work and No Play? Not at .conf26! Unwind at These Evening Events

Join the Hackathon at .conf26 and build a No-Code AI agent

Join the Conversation