Expose Universal Forwarder data ingestion ports

Create a Kubernetes Service for Universal Forwarder data ingestion, and optionally expose the HEC endpoint externally through an Ingress.

The chart supports receiving data pushed from external sources, such as syslog, HEC, or raw TCP, through an optional multi-port Service when service.enabled=true.

  • Enable the Service when you install the chart.
    Name Port Protocol Use
    syslog-udp 514 UDP Syslog over UDP
    syslog-tcp 601 TCP Syslog over TCP
    splunktcp 9997 TCP Splunk-to-Splunk (S2S) input
    hec 8088 TCP HTTP Event Collector
    CODE 
    helm install my-uf ./helm-chart/splunk-universalforwarder \
  --set splunkConfig.forwardServer=indexer.example.com:9997 \
  --set splunkConfig.password=MySecurePassword1 \
  --set splunkConfig.splunkGeneralTerms=<value-from-splunk-general-terms-acceptance-page> \
  --set service.enabled=true \
  --set "splunkConfig.add[0]=udp 514"

    This creates a ClusterIP Service. Change to LoadBalancer for external access:

    CODE 
    --set service.type=LoadBalancer

    Add Service annotations, such as for an AWS NLB:

    CODE 
    --set service.annotations."service\.beta\.kubernetes\.io/aws-load-balancer-type"=nlb
  • Optionally, customize the port list.
    CODE 
    # values-override.yaml
service:
  enabled: true
  ports:
    - name: hec
      port: 8088
      protocol: TCP
    - name: syslog
      port: 514
      protocol: UDP
    Important: service.enabled must be true when ingress.enabled=true. The chart fails at render time if Ingress is enabled without a backing Service.
  • Optionally, expose the HEC endpoint externally with an Ingress.

    Requires service.enabled=true.

    CODE 
    helm install my-uf ./helm-chart/splunk-universalforwarder \
  --set splunkConfig.forwardServer=indexer.example.com:9997 \
  --set splunkConfig.password=MySecurePassword1 \
  --set splunkConfig.splunkGeneralTerms=<value-from-splunk-general-terms-acceptance-page> \
  --set service.enabled=true \
  --set ingress.enabled=true \
  --set ingress.className=nginx \
  --set "ingress.hosts[0].host=hec.example.com" \
  --set "ingress.hosts[0].paths[0].path=/services/collector" \
  --set "ingress.hosts[0].paths[0].pathType=Prefix"

    Optionally, configure TLS for the Ingress.

    CODE 
    # values-override.yaml
service:
  enabled: true

ingress:
  enabled: true
  className: nginx
  annotations:
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
  hosts:
    - host: hec.example.com
      paths:
        - path: /services/collector
          pathType: Prefix
  tls:
    - secretName: hec-tls
      hosts:
        - hec.example.com

The chart exposes the configured ports through the Service, and the Ingress always targets the hec backend port (8088) on the chart Service.