> For the complete documentation index, see [llms.txt](https://docs.bindplane.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.bindplane.com/how-to-guides/cloud-and-platform-integrations/splunk/using-splunk-uf-with-bindplane.md).

# Using Splunk UF with Bindplane

Bindplane and the Bindplane Collector can be used to collect data from your Splunk Universal Forwarders. This allows you to start taking advantage of Bindplane without the need to re-instrument your collectors at the edge.

### Step 1: Update your outputs.conf on your Universal Forwarders

By default, the Splunk Universal Forwarder (UF) sends data over TCP in Splunk’s proprietary Splunk to Splunk (S2S) protocol. In order to allow the Bindplane Collector to receive data from the UF, it will need to be sent in a raw format instead. This is accomplished by creating a Splunk output configuration stanza that disables the S2S protocol by setting the parameter sendCookedData to false.

Below is a sample outputs.conf file, after you’ve made the required changes.

```yaml
[tcpout]
defaultGroup = otel

[tcpout:otel]
server = localhost:8779
compressed = false
useACK = false
sendCookedData = false
```

### Step 2: Deploy a Bindplane Collector as a Gateway

This is the collector you’ll be routing data through and is what will be managed by Bindplane. In a production environment, this is likely to be a fleet of collectors behind a load balancer. See our [Collector Sizing and Scaling](/production-checklist/bindplane-otel-collector/sizing-and-scaling.md) docs for more details on determining your collector architecture.

### Step 3: Build the Configuration

1. Create a new configuration
2. Add the TCP Source and configure it to receive from your Universal Forwarders (as shown below)
3. Add the Splunk destination and configure it to point to your Splunk Enterprise or Splunk Observability Cloud environment.

### Step 4: Transform the Data

Once you’ve verified data is flowing through the Bindplane Collector to Splunk without issue, you can now start re-routing data to different destinations and inserting processors into your pipeline to reduce the amount of data you’re sending.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.bindplane.com/how-to-guides/cloud-and-platform-integrations/splunk/using-splunk-uf-with-bindplane.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.