Skip to main content
Question

is it advised to have both a cribl agent and a splunk universal forwarder installed on a host?

  • March 11, 2025
  • 2 replies
  • 35 views

is it advised to have both a cribl agent and a splunk universal forwarder installed on a host?

2 replies

Raanan Dagan
  • Employee
  • March 11, 2025

It is very much dependent on the use case. However, in most cases the goal is to reduce the number of agents. So we see people moving away from Splunk UF and into Cribl Edge agent


It really depends on how your splunk UF is configured to ingest things in, would strongly suggest testing a bit before you cut over.