---
icon: material/check-circle-outline
title: "Compatibility"
---

Splunk dashboards, Universal Forwarders, testing on your own environment, HEC integration, Splunk Enterprise on-premises, and Splunk Cloud Platform.

??? tenx-compat "Does 10x work with my existing Splunk dashboards and queries"

    **Yes.** Compact events keep `host`, `source` and `index`; their sourcetype is `tenx_encoded`, the one the app expands, and field extractions apply to the expanded text.

    **Fields on a compact event:**

    - `host`, `source`, `index`
    - `sourcetype`, set to `tenx_encoded` by the HEC token
    - `_raw`, expanded at search time
    - Field extractions, applied to the expanded text

    `_time` on a compact event is the time in its original line wherever the template has a timestamp, and the time Splunk indexed it otherwise.

    **How searches reach compact events:**

    - Classic dashboards in an app that carries `dashboard.js` keep their SPL unchanged
    - The search bar, Dashboard Studio panels, saved searches and alerts put the `tx` macro in front of the search terms: ``index=app_logs `tx` error``
    - Alerts created in the **Compile Alert** view are compiled once at save time, so they run natively server-side; an alert saved from the search page with `tx` resolves templates at every run

    **How optimization works:** The 10x Engine uses [template-based](https://doc.log10x.com/run/transform/){target="_blank"} encoding, keeping every value. Each repeated log event is replaced by a compact reference to its template plus the event's values, and stays fully searchable in Splunk. Splunk stores a compact event whole up to 256 KB; the app's [size limit](https://doc.log10x.com/apps/receiver/compact/splunk/#known-limits) section describes what happens to a longer event.

??? tenx-compat "Does this work with Universal Forwarders"

    **Yes.** The 10x [Receiver](https://doc.log10x.com/apps/receiver/){target="_blank"} runs as a file relay in front of [Universal Forwarders](https://doc.log10x.com/run/input/forwarder/splunkUF/){target="_blank"}: Fluent Bit with 10x reads the app's log folder, optimizes, and writes to a second folder the Universal Forwarder monitors. The [Reporter](https://doc.log10x.com/apps/reporter/){target="_blank"} deploys as a DaemonSet alongside them.

    The Universal Forwarder tails that second folder with its standard `inputs.conf` and ships to the indexers over S2S. Forwarding directly to Splunk HEC is a separate option, covered under HEC integration below.

    **Compatibility:** Universal Forwarder 8.0 and later; tested with 8.1, 9.0, 9.1 and 10.4.3. The forwarder's `inputs.conf` monitor stanza points at the folder 10x writes instead of the app's log folder; the rest of its configuration stays as it is.

??? tenx-compat "How do I test this on my Splunk environment"

    1. **[Cost POC](https://doc.log10x.com/apps/mcp/)**: install the 10x MCP and ask it to run a POC on your Splunk logs. The engine runs on your own machine and returns results in minutes, with no account or credit card.
    2. **[Reporter](https://doc.log10x.com/apps/reporter/)**: deploy as a DaemonSet alongside your forwarder for cost visibility before logs reach Splunk. Alternatively, the [MCP server](https://github.com/log-10x/log10x-mcp){target="_blank"}'s SIEM-sample tool connects to Splunk via REST API for agentless Splunk-side analysis (no DaemonSet).
    3. **[Receiver](https://doc.log10x.com/apps/receiver/deploy/)**: deploy via Helm chart alongside your forwarder. Filter mode (sampling) or [Compact mode](https://doc.log10x.com/apps/receiver/compact/) (lossless shrink via the [Log10x App](https://doc.log10x.com/apps/receiver/compact/splunk/)). ~30 min setup.
    4. **[Retriever](https://doc.log10x.com/apps/retriever/)**: route events to S3, stream selected data to Splunk on-demand.

    Each step is independent. Start with the cost POC to see your reduction ratio, then move to production when ready.

??? tenx-compat "How does this integrate with Splunk HEC"

    The 10x Engine runs with the forwarder and processes events before they reach Splunk:

    ```
    App → Fluentd or Fluent Bit → 10x Receiver (Compact mode) → Splunk HEC → Indexer
    App log folder → Fluent Bit + 10x → relay folder → Universal Forwarder → Indexer (S2S)
    ```

    **Execution (Receiver):**

    - Runs as a file relay in front of the Universal Forwarder, or as a sidecar container with Fluentd or OTel
    - Filters (lossy) or compacts (lossless up to 256 KB per event) logs in-memory before forwarding to HEC
    - Uses standard HEC token authentication
    - Can also forward via splunktcp to indexers (standard UF protocol)

    **Observability (Reporter):**

    - Deploys as a DaemonSet alongside your forwarder (logs never pass through it)
    - Emits pre-ingestion cost insight metrics to the time-series backend you configure (Prometheus, Datadog, CloudWatch, Elastic)
    - Runs independently: logs keep flowing to Splunk while the Reporter is down

    **Fetching from S3:**

    - [Retriever](https://doc.log10x.com/apps/retriever/){target="_blank"} routes events to your own S3 and returns the exact offloaded events to HEC on-demand

    **Agentless Splunk analysis:** The [MCP server](https://github.com/log-10x/log10x-mcp){target="_blank"}'s SIEM-sample tool queries Splunk REST API for cost analysis without deploying a DaemonSet.

    **Compatibility:** The Receiver and Reporter send to any Splunk HEC endpoint, on Splunk Cloud Platform or Splunk Enterprise. No changes to HEC configuration required. The Log10x App, which expands compact events, supports Splunk Enterprise 9.4 through 10.6.

??? tenx-compat "Works with Splunk Enterprise on-premises"

    **Yes.** The Receiver, Reporter and Retriever work with Splunk Enterprise on-premises across single-instance, distributed, and clustered deployments. The Log10x App supports Splunk Enterprise 9.4 through 10.6.

    On-premises, the Receiver sidecar and Reporter DaemonSet forward to HEC or to Heavy Forwarders, using either HEC token or Heavy Forwarder S2S authentication.

    **Agentless Splunk analysis via [log10x-mcp](https://github.com/log-10x/log10x-mcp){target="_blank"} for on-premises:**

    - SIEM-sample tool queries Splunk Enterprise REST API
    - Requires admin or power user credentials
    - Runs wherever you run an MCP server (workstation, CI, infrastructure)
    - No data egress to external systems

    **[Retriever](https://doc.log10x.com/apps/retriever/){target="_blank"} for on-premises:** Reads AWS S3 and any S3-compatible [object storage](https://doc.log10x.com/run/input/objectStorage/){target="_blank"}, where the Receiver offloads, and Azure Blob Storage for logs already stored there. Returns the exact events to Splunk Enterprise HEC endpoints on demand.

??? tenx-compat "Does the Log10x App run on Splunk Cloud Platform"

    The [Log10x App](https://doc.log10x.com/apps/receiver/compact/splunk/) package passes AppInspect's Splunk Cloud checks, and on Splunk Cloud Platform it installs as an uploaded app after Splunk's own vetting. On Splunk Enterprise the app is tested on 9.4, 10.0, 10.2, 10.4 and 10.6.

    Setup is the same on both: install the app, create the `tenx_dml` index and two HEC tokens, point the Receiver at them, set the `tenx-events` macro, and run the backfill search once if templates were indexed before the app. The app creates its KV Store collection itself. See the [Quickstart](https://doc.log10x.com/apps/receiver/compact/splunk/#quickstart).

    The app runs Python on the search head: the `tenxprefilter` command the `tx` macro runs once per search, the `tx` and `tenxsearch` commands, the `/tenx-search` and `/tenx-alert` endpoints, and the alert action that stores templates. The app's calls all stay inside the Splunk deployment.