Enable the Universal Forwarder as an optional sub-chart dependency of splunk-enterprise.
The splunk-universalforwarder chart is included as an optional dependency, turned off by default, in helm-chart/splunk-enterprise/. All splunk-universalforwarder values are namespaced under splunk-universalforwarder.* when used as a sub-chart.
- Enable it when installing splunk-enterprise.
helm install my-stack ./helm-chart/splunk-enterprise \
--namespace my-namespace \
--set splunk-universalforwarder.enabled=true \
--set "splunk-universalforwarder.splunkConfig.forwardServer=<indexer-svc>.<namespace>.svc.cluster.local:9997" \
--set splunk-universalforwarder.splunkConfig.password=MySecurePassword1 \
--set "splunk-universalforwarder.splunkConfig.splunkGeneralTerms=<value-from-splunk-general-terms-acceptance-page>"
- Alternatively, enable it when upgrading an existing splunk-enterprise release.
helm upgrade my-stack ./helm-chart/splunk-enterprise \
--namespace my-namespace \
--values values-production.yaml \
--set splunk-universalforwarder.enabled=true \
--set "splunk-universalforwarder.splunkConfig.forwardServer=splunk-my-stack-standalone-service.my-namespace.svc.cluster.local:9997" \
--set splunk-universalforwarder.splunkConfig.password=MySecurePassword1 \
--set "splunk-universalforwarder.splunkConfig.splunkGeneralTerms=<value-from-splunk-general-terms-acceptance-page>"