CODEWITHSUNDEEP
compatibilitysplunkfluentd
user1640555533423
user1640555533423

Reputation: 45

Is the Splunk Universal Forwarder capable of sending data to FluentD

I have multiple Splunk Universal Forwarders, and I am looking to send them to an ETL tool. I am trying to evaluate whether FluentD is a compatible option for this.

FluentD has built in plug-ins for many specific log collection tools, however the Splunk UF is not listed as one of them. However, FluentD is capable of receiving traffic over HTTPS, and Splunk is capable of sending log data over HTTPS, does this mean the two are compatible?

Upvotes: 0

Views: 695

Answers (2)

steoleary
steoleary

Reputation: 9278

No it is not compatible, even though the Universal forwarder sends data over HTTPS, the data is still using the S2S proprietary protocol, so even if you set FluentD up to receive the data, it wouldn't know what to do with it as it won't be able to decode it.

Upvotes: 0

RichG
RichG

Reputation: 9926

Splunk's Universal Forwarder (UF) can send data using the Splunk-to-Splunk protocol or Splunk HTTP Event Collector (HEC) format.

Why not use Splunk instead of FluentD? Or use Cribl instead of a UF to send to FluentD?

Upvotes: 1

Related Questions