Splunk Enterprise

Using Splunk Universal forwarder to third party logger?

kuhnto
New Member

We are investigating various logging clients to send to our current log server.  Splunk UF is one.  We are in a long term position of getting splunk enterprise as a new logger, but prior to that, as an interim, were considering Splunk UF.  The documentation seems to point to interoperability with third party loggers.  Is there and licensing that needs to be purchased to use Splunk UF with  a non-Splunk logger server, or is it free to download that that use?

Labels (1)
0 Karma

tscroggins
Influencer

@kuhnto 

You can stream raw chunks over TCP to third-party systems by setting sendCookedData = false in a custom tcpout stanza in outputs.conf. E.g:

[tcpout]
defaultGroup = foo

[tcpout:foo]
server = 192.0.2.1:1234, bar.example.com:4567
sendCookedData = false

See https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Forwarddatatothird-partysystemsd for more information.

You do lose all parsing functionality when forwarding to third-party systems. You can technically use Splunk Enterprise in a similar way--Splunk Universal Forwarder and Splunk Enterprise share the same codebase--but some functionality is disabled without a license.

I recommend contacting Splunk and/or legal counsel regarding Splunk Universal Forwarder licensing.

0 Karma
Get Updates on the Splunk Community!

Message Parsing in SOCK

Introduction This blog post is part of an ongoing series on SOCK enablement. In this blog post, I will write ...

Exploring the OpenTelemetry Collector’s Kubernetes annotation-based discovery

We’ve already explored a few topics around observability in a Kubernetes environment -- Common Failures in a ...

Use ‘em or lose ‘em | Splunk training units do expire

Whether it’s hummus, a ham sandwich, or a human, almost everything in this world has an expiration date. And, ...