Forwarding configuration options for the Universal Forwarder

The splunk-universalforwarder Helm chart renders different forwarding configuration depending on which forwarding option you set.

The chart renders differently depending on which forwarding option you use.

Single direct indexer

Set a single downstream indexer with splunkConfig.forwardServer:

CODE 
--set splunkConfig.forwardServer=indexer.example.com:9997

The chart writes default.yml with forward_servers and s2s_port. Ansible calls splunk add forward-server during startup, which produces:

CODE 
# /opt/splunkforwarder/etc/system/local/outputs.conf
[indexAndForward]
index = false

[tcpout]
defaultGroup = default-autolb-group

[tcpout:default-autolb-group]
server = indexer.example.com:9997

Multiple direct indexers

For multiple indexers, use the splunkConfig.forwardServers list. It takes precedence over forwardServer when non-empty.

CODE 
# values-override.yaml
splunkConfig:
  forwardServers:
    - idx1.example.com:9997
    - idx2.example.com:9997
  password: MySecurePassword1
  splunkGeneralTerms: "<value-from-splunk-general-terms-acceptance-page>"
CODE 
helm install my-uf ./helm-chart/splunk-universalforwarder \
  --values values-override.yaml

The first entry is used as the forward_servers host and s2s_port written to default.yml.

Deployment server

CODE 
--set splunkConfig.deploymentServer=ds.example.com:8089 \
--set splunkConfig.deploymentClientName=my-cluster-uf

The UF registers with the deployment server (DS) on startup. The DS pushes a deployment app that contains outputs.conf. The chart writes no static outputs.conf at install time.

Advanced: raw .conf files

For multi-indexer load balancing or custom routing that the forwardServer shortcut cannot express, use conf.outputs and conf.inputs:

CODE 
# values-override.yaml
conf:
  outputs: |
    [tcpout]
    defaultGroup = primary-indexers

    [tcpout:primary-indexers]
    server = idx1.example.com:9997,idx2.example.com:9997
    autoLBFrequency = 30
    useACK = true

  inputs: |
    [monitor:///var/log/app/*.log]
    index = app_logs
    sourcetype = app_json
CODE 
helm install my-uf ./helm-chart/splunk-universalforwarder \
  --values values-override.yaml \
  --set splunkConfig.forwardServer=idx1.example.com:9997

A ConfigMap mounts the .conf files at system/local/, which shadows Ansible-written files at that path.

Important: One of splunkConfig.forwardServer, splunkConfig.forwardServers, or splunkConfig.deploymentServer must always be set. The chart fails to render if all three are empty.

Adding monitors

CODE 
--set splunkConfig.add[0]="monitor /var/log/syslog" \
--set splunkConfig.add[1]="udp 514"

Each entry maps to a splunk add call during Ansible init. The items are comma-joined into SPLUNK_ADD.

Encrypted forwarding (SSL)

Enable SSL for encrypted Splunk-to-Splunk forwarding by mounting a certificate Secret in the chart.

  1. Create a Secret containing your S2S certificate and CA.

    CODE 
    kubectl create secret generic uf-s2s-certs \
  --namespace my-namespace \
  --from-file=tls.crt=./s2s-cert.pem \
  --from-file=ca.crt=./ca-cert.pem

  2. Enable SSL when you install the chart.

    CODE 
    helm install my-uf ./helm-chart/splunk-universalforwarder \
  --set splunkConfig.forwardServer=indexer.example.com:9997 \
  --set splunkConfig.password=MySecurePassword1 \
  --set splunkConfig.ssl.secretName=uf-s2s-certs \
  --set splunkConfig.splunkGeneralTerms=<value-from-splunk-general-terms-acceptance-page>

    The chart:

    1. Mounts the Secret at /opt/splunkforwarder/etc/auth/s2s/ (configurable with splunkConfig.ssl.mountPath).
    2. Sets SPLUNK_S2S_CERT=/opt/splunkforwarder/etc/auth/s2s/tls.crt.
    3. Sets SPLUNK_S2S_CA=/opt/splunkforwarder/etc/auth/s2s/ca.crt.

    Ansible wires these into server.conf for encrypted S2S forwarding. This works with any replicaCount.

  3. Optionally, use different key names within the Secret.

    CODE 
    --set splunkConfig.ssl.certKey=splunk-s2s.crt \
--set splunkConfig.ssl.caKey=splunk-ca.crt

Ansible configures the Universal Forwarder for encrypted S2S forwarding using the mounted certificate and CA.