Getting Data In

Can the Universal Forwarder send logs to an AWS S3 bucket?

RecoMark0
Path Finder

Hello,
We would like to be able to have our universal forwarders that are installed on AWS instances, to forward logs/indexes to an S3 bucket(instead of an indexer). Our client will then use their own splunk to read them. Is this possible?

We want to avoid just sending all our logs for this client to S3, as we have a lot of different logs, and maintaining an in house script to this would be high. So using splunk is our first choice, but I have been unable to find this feature specifically.

0 Karma
1 Solution

_d_
Splunk Employee
Splunk Employee

The short answer is no. The Universal Forwarder will happily send data to a set of Splunk receivers but not directly to S3.
However, you can chose to retire Splunk data to S3 if you'd like.

View solution in original post

_d_
Splunk Employee
Splunk Employee

The short answer is no. The Universal Forwarder will happily send data to a set of Splunk receivers but not directly to S3.
However, you can chose to retire Splunk data to S3 if you'd like.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...