Install the Universal Forwarder Helm chart

Install the splunk-universalforwarder Helm chart with a forwarding target, a custom password, and Splunk General Terms acceptance.

Review the following requirements before you install the chart.

Requirement Notes
Helm v3.x
Kubernetes See the Splunk Operator release and version compatibility matrix for supported versions.
PersistentVolume provisioner Only required when storage.emptyDir: false
helm-unittest plugin Only needed to run helm unittest

Splunk General Terms

Important: Use of the Splunk Universal Forwarder image requires acceptance of the Splunk General Terms. See the Splunk General Terms Acceptance section of the Splunk Operator documentation for the required SPLUNK_GENERAL_TERMS environment variable and the legal language you must accept before setting it.

At minimum, set one of splunkConfig.forwardServer or splunkConfig.deploymentServer, a non-default password, and explicit acceptance of the Splunk General Terms.

Important: The chart fails at render time if splunkConfig.splunkGeneralTerms is not set to the required value. See the Splunk General Terms Acceptance section of the Splunk Operator documentation for the required value and legal language.
CAUTION: Values passed with --set appear in shell history. For production use, use a --values file or splunkConfig.existingSecret instead. See Manage the Universal Forwarder admin password.
Important: The chart fails at render time if splunkConfig.password is the default changeme and no existingSecret is provided. Always set a custom password.
  1. Install the chart with the required values.
    CODE 
    helm install my-uf ./helm-chart/splunk-universalforwarder \
  --namespace my-namespace \
  --create-namespace \
  --set splunkConfig.forwardServer=indexer.example.com:9997 \
  --set splunkConfig.password=MySecurePassword1 \
  --set splunkConfig.splunkGeneralTerms=<value-from-splunk-general-terms-acceptance-page>
  2. Verify that the pod is running.
    CODE 
    kubectl get pods -n my-namespace -l app.kubernetes.io/name=splunk-universalforwarder
  3. Verify that forwarding is active.
    CODE 
    kubectl exec -n my-namespace <pod-name> -- \
  grep "AutoLoadBalancedConnectionStrategy" \
  /opt/splunkforwarder/var/log/splunk/splunkd.log | tail -5

The pod starts and begins forwarding data to the configured indexer or deployment server.