Splunk Enterprise

What is the best practice to send logs from universal forwarder to indexer?

kristen
Engager

I saw that there are two options to send logs from universal forwarder to indexer.

We can use [httpout] to send the logs to HTTP Event Collector on the indexer on port 8088;

alternatively, we can use [tcpout] to send the logs to the indexer on port 9997.

 

Which one is the best practice to implement? Thanks.

Labels (1)
Tags (1)
0 Karma
1 Solution

gcusello
Esteemed Legend

Hi @kristen,

HEC is mainly for applications or if you cannot use tcpout or syslog,

if possible use always tcpout!

Splunk created this way to send logs from Forwarders to Indexers that's optimized (compressed, eventually encrypted, regulated in bandwidth, managing failover and loadbalancing, etc...).

Ciao.

Giuseppe

View solution in original post

gcusello
Esteemed Legend

Hi @kristen,

HEC is mainly for applications or if you cannot use tcpout or syslog,

if possible use always tcpout!

Splunk created this way to send logs from Forwarders to Indexers that's optimized (compressed, eventually encrypted, regulated in bandwidth, managing failover and loadbalancing, etc...).

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...