Storage configuration options for the Universal Forwarder

The Universal Forwarder Helm chart defaults to stateless emptyDir storage, with an option for durable PersistentVolumeClaims.

Choose a storage mode based on whether forwarding state needs to survive pod restarts.

Stateless mode (default)

Both etc/ and var/ are backed by emptyDir volumes on the node's local disk. No PVCs are created. On pod restart, Splunk initializes from scratch: Ansible re-runs, outputs.conf is rewritten from the Secret, and forwarding resumes.

This is the right choice for a pure forwarding tier that receives data over the network or from a deployment server, where re-initializing on restart is acceptable.

CODE 
# No extra flags needed. This is the default.
helm install my-uf ./helm-chart/splunk-universalforwarder \
  --set splunkConfig.forwardServer=indexer.example.com:9997 \
  --set splunkConfig.password=MySecurePassword1 \
  --set splunkConfig.splunkGeneralTerms=<value-from-splunk-general-terms-acceptance-page>

Durable mode

The chart creates two PersistentVolumeClaims. They persist across pod restarts and helm upgrade. They are not deleted on helm uninstall.

PVC Mount Default size Contains
release-splunk-universalforwarder-etc /opt/splunkforwarder/etc 1Gi Config files, splunk.secret, passwd
release-splunk-universalforwarder-var /opt/splunkforwarder/var 5Gi Runtime data, fishbucket, logs

Use this when splunkConfig.add includes a monitor input and you need the fishbucket to survive restarts to avoid re-indexing duplicate data.

CODE 
helm install my-uf ./helm-chart/splunk-universalforwarder \
  --set storage.emptyDir=false \
  --set splunkConfig.forwardServer=indexer.example.com:9997 \
  --set splunkConfig.password=MySecurePassword1 \
  --set splunkConfig.splunkGeneralTerms=<value-from-splunk-general-terms-acceptance-page> \
  --set "splunkConfig.add[0]=monitor /var/log/app/*.log"

Resize the PVCs:

CODE 
--set storage.etcSize=2Gi \
--set storage.varSize=10Gi

Use a specific StorageClass:

CODE 
--set storage.storageClassName=gp3