Configure forwarders to send Splunk SOAR data to your Splunk deployment
Share your Splunk SOAR data with your Splunk Enterprise or Splunk Cloud Platform deployment, using universal forwarders. Universal forwarders stream data from your Splunk SOAR deployment to a data receiver, which is usually a Splunk platform index where you store your data.
See also
For details on setting up universal forwarders:
- Splunk SOAR (Cloud): Configure forwarders to send SOAR data to your Splunk deployment in the Administer Splunk SOAR (Cloud) documentation
- Splunk SOAR (On-premises): Configure forwarders to send SOAR data to your Splunk deployment in the Administer Splunk SOAR (On-premises) documentation.
For Splunk App for SOAR users:
Set up the universal forwarder using Splunk SOAR in the Install and Configure Splunk App for SOAR documentation.