All configuration fields for the Universal Forwarder Helm chart

Look up every configurable field, default value, and description for the splunk-universalforwarder Helm chart.

The following tables list every field the chart accepts, grouped by category.

Image

Field Default Description
image.repository docker.io/splunk/universalforwarder Container image registry and name
image.tag 10.4.0 Splunk UF image tag or version
image.pullPolicy IfNotPresent Kubernetes image pull policy
image.imagePullSecrets [] Pull secrets for private registries
initImage.repository docker.io/library/busybox Pinned busybox image for the fix-ownership init container
initImage.tag 1.36.1 busybox version

Workload

Field Default Description
replicaCount 1 Number of Deployment replicas
updateStrategy RollingUpdate maxSurge=1 maxUnavailable=0 Deployment update strategy
minReadySeconds 0 Seconds a new pod must be Ready before counted available
podAnnotations {} Annotations added to each pod
deploymentAnnotations {} Annotations added to the Deployment
nodeSelector {} Node selector labels
tolerations [] Pod tolerations
affinity {} Pod affinity/antiaffinity rules
nameOverride "" Override the chart name component
fullnameOverride "" Override the full release name
namespaceOverride "" Deploy into a different namespace than the release

Splunk configuration

Field Default Description
splunkConfig.password changeme Admin password. Must be changed; the chart fails if left as default.
splunkConfig.existingSecret "" Name of a pre-existing Secret; skips chart Secret creation and password validation
splunkConfig.passwordKey password Key within the Secret holding the password
splunkConfig.forwardServer "" host:port of the downstream indexer (required unless deploymentServer or forwardServers is set)
splunkConfig.forwardServers [] List of indexer endpoints; takes precedence over forwardServer when non-empty
splunkConfig.splunkGeneralTerms "" Required. Set to the value from the Splunk General Terms Acceptance section after reviewing and accepting the terms. The chart fails at render time if it is not set correctly.
splunkConfig.deploymentServer "" host:port of the deployment server
splunkConfig.deploymentClientName "" Client name reported to the deployment server
splunkConfig.add [] List of splunk add arguments, such as ["monitor /var/log/app/*.log"]
splunkConfig.defaultsUrl "" URL of a remote default.yml; overrides the default /mnt/splunk-secrets/default.yml
splunkConfig.ssl.secretName "" Secret containing the S2S TLS certificate and CA
splunkConfig.ssl.certKey tls.crt Key within the SSL Secret for the TLS certificate
splunkConfig.ssl.caKey ca.crt Key within the SSL Secret for the CA certificate
splunkConfig.ssl.mountPath /opt/splunkforwarder/etc/auth/s2s Mount path for the SSL Secret inside the container

Raw .conf files

Field Default Description
conf.outputs "" Raw outputs.conf content; mounted through a ConfigMap at system/local/outputs.conf
conf.inputs "" Raw inputs.conf content; mounted through a ConfigMap at system/local/inputs.conf

Storage

Field Default Description
storage.emptyDir true Use emptyDir (stateless). Set false for PVC-backed durable mode.
storage.storageClassName "" StorageClass for PVCs; empty means the cluster default (durable mode only)
storage.etcSize 1Gi Size of the PVC for /opt/splunkforwarder/etc (durable mode only)
storage.varSize 5Gi Size of the PVC for /opt/splunkforwarder/var (durable mode only)
persistence.enabled false Legacy hostPath fishbucket (not used in Deployment mode)

Service

Field Default Description
service.enabled false Create a Service
service.type ClusterIP Kubernetes Service type (ClusterIP, NodePort, LoadBalancer)
service.annotations {} Annotations on the Service, such as cloud load balancer annotations
service.ports see below List of port definitions; each has name, port, protocol

Default service.ports:

JSON 
- { name: syslog-udp, port: 514,  protocol: UDP }
- { name: syslog-tcp, port: 601,  protocol: TCP }
- { name: splunktcp,  port: 9997, protocol: TCP }
- { name: hec,        port: 8088, protocol: TCP }

Ingress

Field Default Description
ingress.enabled false Create an Ingress for HEC; requires service.enabled=true
ingress.className "" Ingress class, such as nginx or alb
ingress.annotations {} Ingress annotations
ingress.hosts [{host: "", paths: [{path: /services/collector, pathType: Prefix}]}] Ingress host rules
ingress.tls [] TLS configuration

PodDisruptionBudget

Field Default Description
podDisruptionBudget.enabled false Create a PodDisruptionBudget
podDisruptionBudget.minAvailable 1 Minimum available pods during disruption

NetworkPolicy

Field Default Description
networkPolicy.enabled false Create a NetworkPolicy
networkPolicy.ingress [] Ingress rules (empty means deny all inbound)
networkPolicy.egress [] Egress rules (empty means deny all outbound)

Resources

Field Default Description
resources.limits.cpu 200m CPU limit
resources.limits.memory 500Mi Memory limit
resources.limits.ephemeral-storage 1Gi Ephemeral storage limit (prevents node DiskPressure)
resources.requests.cpu 100m CPU request
resources.requests.memory 200Mi Memory request

Probes

Field Default Description
startupProbe.initialDelaySeconds 0 Seconds before the first startup probe
startupProbe.periodSeconds 15 Startup probe interval
startupProbe.failureThreshold 40 Max failures before the pod is restarted (40x15s = 600s max startup)
startupProbe.timeoutSeconds 10 Seconds to wait for a probe response
readinessProbe.initialDelaySeconds 0 Seconds before the first readiness probe (startupProbe gates this)
readinessProbe.periodSeconds 15 Readiness probe interval
readinessProbe.failureThreshold 5 Consecutive failures before the pod is removed from Service endpoints
readinessProbe.timeoutSeconds 10 Seconds to wait for a probe response
livenessProbe.initialDelaySeconds 0 Seconds before the first liveness probe (startupProbe gates this)
livenessProbe.periodSeconds 30 Liveness probe interval
livenessProbe.failureThreshold 3 Consecutive failures before the container is restarted
livenessProbe.timeoutSeconds 10 Seconds to wait for a probe response

Security

Field Default Description
podSecurityContext.runAsUser 41812 Splunk user uid
podSecurityContext.runAsNonRoot true Block root in the main and seed-etc containers
podSecurityContext.fsGroup 41812 GID applied to PVC volume mounts by the CSI driver
podSecurityContext.fsGroupChangePolicy Always Always re-apply fsGroup on mount
containerSecurityContext.allowPrivilegeEscalation false Block setuid/setgid
containerSecurityContext.runAsNonRoot true Block root in the main container
containerSecurityContext.runAsUser 41812 Run as the splunk user
containerSecurityContext.capabilities.drop [ALL] Drop all Linux capabilities

ServiceAccount and RBAC

Field Default Description
serviceAccount.create true Create a ServiceAccount
serviceAccount.name "" Override the ServiceAccount name (defaults to the release fullname)
serviceAccount.annotations {} Annotations, such as for IRSA (eks.amazonaws.com/role-arn)
rbac.create true Create a Role/ClusterRole and Binding
rbac.clusterScoped false Use a ClusterRole instead of a namespace-scoped Role

Debugging and extras

Field Default Description
debug.enabled false Set SPLUNK_ANSIBLE_DEBUG=true for verbose Ansible output
extraManifests [] Arbitrary extra Kubernetes resources rendered as Go templates