Configure forwarders to send Splunk SOAR data to your Splunk deployment

Share your Splunk SOAR data with your Splunk Enterprise or Splunk Cloud Platform deployment, using universal forwarders. Universal forwarders stream data from your Splunk SOAR deployment to a data receiver, which is usually a Splunk platform index where you store your data.

See also

For details on setting up universal forwarders:
Configure forwarders to send SOAR data to your Splunk deployment in the Administer Splunk SOAR (Cloud) documentation.

For Splunk App for SOAR users:
Set up the universal forwarder using Splunk SOAR version 6.2.0 and higher in the Install and Configure Splunk App for SOAR documentation.