Can I configure universal forwarder to listen to a TCP port?

[neltonk]

I have a network appliance publishing log to a remote server which has universal forwarder installed... Is it possible to configure the universal forwarder to listen to the port (TCP) and forward it to indexer?

Please help...

Thanks,
Splunk Newbie

[e343976]

Yes, you can do this easily.

inputs.conf:
[tcp://:$PORT]
index=indexname
source=sourcename
sourcetype=sourcetypename

outputs.conf
[tcpout]
server = $IP

[richgalloway]

Universal forwarders don't listen to ports for events. You should use another program (like rsyslog or syslog-ng) to listen for log data and write it to a file. The universal forwarder can monitor that file and send events to Splunk as they are written.

[adobrzeniecki]

@richgalloway  I cannot find any documentation on caveats or issues with TCP inputs on UFs. I am in a bit of a quandry, my customer is in Cloud, does not have a HF on prem. They have an IDM in cloud, but the cloud team told us we cannot configure TCP inputs on an IDM. We do have a UF on prem. Could we setup the TCP inputs on the UF without any issues moving forward? This is for Zscaler.

[richgalloway]

TCP inputs are not allowed in Splunk Cloud at all so you must have an on-prem instance to do it.

Another respondent says UFs can listen for TCP input.  Try it.  If it doesn't work, use a HF.  If your customer can run a UF they probably can run a HF.

[alemarzu]

In addition to what @richgalloway said, you could also use a Heavy Forwarder instead of UF as they can be configured to listen and forward events to the Indexer/s.