Skip to content

Splunk Universal Forwarder

manual

Requires a splunk.com login, so it can't be fetched during the build.

Splunk Universal Forwarder screenshot

Location

/opt/detectops/logging-siem/splunk-uf/README.txt

Manual step required

see that README for the build-time steps — must go through config/packages.chroot/, not a hook drop-in, or the installer purges it on first boot

Reference

https://www.splunk.com/en_us/download/universal-forwarder.html

Part of the Logging & SIEM toolset in DetectOps.