Deploy the Universal Forwarder using Helm

The splunk-universalforwarder Helm chart deploys a lightweight Splunk agent that forwards logs and metrics to a Splunk indexer or deployment server.

A Splunk Universal Forwarder is a lightweight Splunk agent that tails files, listens on network ports, and streams data to a downstream Splunk indexer over TCP port 9997 (the S2S protocol). Running it as a Kubernetes workload lets you centralize log collection without depending on node-level log shipping agents.

This chart:

• Runs as a Deployment collecting logs from workloads or network inputs.
• Manages the admin password, Ansible default.yml, and outputs.conf entirely from Helm values. No manual pod exec is required.
• Defaults to stateless storage (storage.emptyDir: true). The pod restarts cleanly from scratch with no PVCs required. Set storage.emptyDir: false to use PersistentVolumeClaims for durable fishbucket checkpoints when monitoring local files.
• Mirrors the security posture of the splunk-operator Standalone CRD: uid 41812, drop all capabilities, no privilege escalation.
• Uses startupProbe (40x15s = 600s max) to handle slow Ansible init gracefully, keeping liveness and readiness probes responsive once Splunk is up.

helm install my-uf ./helm-chart/splunk-universalforwarder \
  --set replicaCount=2 \
  --set splunkConfig.forwardServer=indexer.example.com:9997 \
  --set splunkConfig.password=MySecurePassword1 \
  --set splunkConfig.splunkGeneralTerms=<value-from-splunk-general-terms-acceptance-page>