Splunk Enterprise

What is the best practice to send logs from universal forwarder to indexer?

kristen
Explorer

I saw that there are two options to send logs from universal forwarder to indexer.

We can use [httpout] to send the logs to HTTP Event Collector on the indexer on port 8088;

alternatively, we can use [tcpout] to send the logs to the indexer on port 9997.

 

Which one is the best practice to implement? Thanks.

Labels (1)
Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @kristen,

HEC is mainly for applications or if you cannot use tcpout or syslog,

if possible use always tcpout!

Splunk created this way to send logs from Forwarders to Indexers that's optimized (compressed, eventually encrypted, regulated in bandwidth, managing failover and loadbalancing, etc...).

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @kristen,

HEC is mainly for applications or if you cannot use tcpout or syslog,

if possible use always tcpout!

Splunk created this way to send logs from Forwarders to Indexers that's optimized (compressed, eventually encrypted, regulated in bandwidth, managing failover and loadbalancing, etc...).

Ciao.

Giuseppe

Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...