Splunk Enterprise

What is the best practice to send logs from universal forwarder to indexer?

kristen
Explorer

I saw that there are two options to send logs from universal forwarder to indexer.

We can use [httpout] to send the logs to HTTP Event Collector on the indexer on port 8088;

alternatively, we can use [tcpout] to send the logs to the indexer on port 9997.

 

Which one is the best practice to implement? Thanks.

Labels (1)
Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @kristen,

HEC is mainly for applications or if you cannot use tcpout or syslog,

if possible use always tcpout!

Splunk created this way to send logs from Forwarders to Indexers that's optimized (compressed, eventually encrypted, regulated in bandwidth, managing failover and loadbalancing, etc...).

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @kristen,

HEC is mainly for applications or if you cannot use tcpout or syslog,

if possible use always tcpout!

Splunk created this way to send logs from Forwarders to Indexers that's optimized (compressed, eventually encrypted, regulated in bandwidth, managing failover and loadbalancing, etc...).

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...