Hi, We're setting up a Splunk enterprise instance in an air-gapped environment. In addition to this, the server is situated behind a diode, making all traffic one-way. I've gotten the Splunk Universal Forwarders to send logs over http to the HEC, but the diode doesn't support chunked http-encoding. It isn't possible to turn off http 1.1-support in the diode. In the server, there's the option "forceHttp10", but since the client and server doesn't negotiate the http-version it has no effect. Is there an option in the UF to turn off http 1.1 or chunking for httpout? TIA Johan
... View more