> ## Documentation Index
> Fetch the complete documentation index at: https://docs.chronosphere.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Splunk UF source plugin

export const entity_0 = "Splunk UF source plugin"

export const plugin_0 = "Splunk UF source plugin"

You can use the Splunk UF [source plugin](/ingest/pipeline/plugins/source-plugins)
(name: `tcp`, alias: `Splunk_UF`) to ingest data from your Splunk Universal
Forwarder instances into a telemetry pipeline.

This is a [push-based](/ingest/pipeline/plugins/source-plugins#push-based-and-pull-based-source-plugins) source plugin.

## Supported telemetry types

The {plugin_0} for Chronosphere Telemetry Pipeline supports these telemetry types:

|                    Logs                    |             Metrics             |              Traces             |
| :----------------------------------------: | :-----------------------------: | :-----------------------------: |
| <Icon icon="circle-check" color="green" /> | <Icon icon="ban" color="red" /> | <Icon icon="ban" color="red" /> |

## Configuration parameters

Use the parameters in this section to configure the {entity_0}. The
Telemetry Pipeline web interface uses the items in the **Name** column to
describe these parameters. [Pipeline configuration files](/ingest/pipeline/v2/configure/config-files)
use the items in the **Key** column as YAML keys.

### Required

| Name     | Key    | Description                                                      | Default |
| -------- | ------ | ---------------------------------------------------------------- | ------- |
| **Port** | `port` | Required. The TCP port used for listening for incoming messages. | `5170`  |

### Advanced

| Name                    | Key             | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                     | Default |
| ----------------------- | --------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- |
| **Format**              | `format`        | Sets the format. Accepted values: `json`, *none*.                                                                                                                                                                                                                                                                                                                                                                                                               | *none*  |
| **Set Separator**       | `separator`     | Sets separator.                                                                                                                                                                                                                                                                                                                                                                                                                                                 | *none*  |
| **Chunk Size**          | `chunk_size`    | Sets the chunk size for incoming messages.                                                                                                                                                                                                                                                                                                                                                                                                                      | `256kb` |
| **Buffer Size**         | `buffer_size`   | Sets the chunk size for incoming JSON messages. These chunks are then stored and managed in the space available by `buffer_size`.                                                                                                                                                                                                                                                                                                                               | *none*  |
| **Memory Buffer Limit** | `mem_buf_limit` | For pipelines with the Deployment or DaemonSet [workload](/ingest/pipeline/v2/configure/kubernetes/workloads) type only. Sets a limit for how much buffered data the plugin can write to memory, which affects [backpressure](/ingest/pipeline/v2/configure/backpressure). This value must follow Fluent Bit's rules for [unit sizes](https://docs.fluentbit.io/manual/administration/configuring-fluent-bit#unit-sizes). If unspecified, no limit is enforced. | *none*  |

### Security and TLS

| Name                           | Key              | Description                                                                                                                                               | Default |
| ------------------------------ | ---------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- |
| **TLS**                        | `tls`            | If `true`, enables TLS/SSL. If `false`, disables TLS/SSL. Accepted values: `true`, `false`.                                                               | `false` |
| **TLS Certificate Validation** | `tls.verify`     | If `on`, and if `tls` is `true`, enables TLS/SSL certificate validation. If `off`, disables TLS/SSL certificate validation. Accepted values: `on`, `off`. | `on`    |
| **TLS Debug Level**            | `tls.debug`      | Sets TLS debug verbosity level. Accepted values: `0` (No debug), `1` (Error), `2` (State change), `3` (Informational), `4` (Verbose).                     | `1`     |
| **CA Certificate File Path**   | `tls.ca_file`    | Absolute path to CA certificate file.                                                                                                                     | *none*  |
| **Certificate File Path**      | `tls.crt_file`   | Absolute path to certificate file.                                                                                                                        | *none*  |
| **Private Key File Path**      | `tls.key_file`   | Absolute path to private key file.                                                                                                                        | *none*  |
| **Private Key Path Password**  | `tls.key_passwd` | Password for private key file.                                                                                                                            | *none*  |
| **TLS SNI Hostname Extension** | `tls.vhost`      | Hostname to be used for TLS SNI extension.                                                                                                                | *none*  |

## Splunk Universal Forwarder configuration

```text theme={null}
[tcpout]
defaultGroup = calyptia
disabled = false

[tcpout:calyptia]
server = <CALYPTIA CORE HOST>:<PIPELINE PORT>
sendCookedData = false
negotiateProtocolLevel = 0
```