topic How to connect a heavy forwarder to Splunk Cloud? in Splunk Cloud Platform

How to connect a heavy forwarder to Splunk Cloud?

Dayane_tr — Wed, 22 Jun 2022 21:42:53 GMT

Hello,

I have a linux machine where Splunk Enterprise is installed and I would like to use Heavy forwarder to send the files to the cloud.

How do I install the "app"(splunkclouduf.spl) from the cloud instance in Splunk Enterprise?

I don't have access to the Splunk Enterprise web interface, only access to the linux machine.

Regards

Re: How to connect a heavy forwarder to Splunk Cloud?

richgalloway — Thu, 23 Jun 2022 00:18:26 GMT

Install the app like you would install any other app on the command line. Untar the file to $SPLUNK_HOME/etc/apps then restart the HF.

tar -zxf splunkclouduf.spl -C /opt/splunk/etc/apps

Re: How to connect a heavy forwarder to Splunk Cloud?

Roy_9 — Sat, 25 Jun 2022 08:00:21 GMT

@Dayane_tr After the untar is done as rich suggested, you should open a FW connection from HF to Splunk Cloud(basically will be as inputs*.abc.splunkcloud.com) something like that on port 9997.

Re: How to connect a heavy forwarder to Splunk Cloud?

PickleRick — Sat, 25 Jun 2022 08:55:13 GMT

I never remember the proper syntax, but it's either

/opt/splunk/bin/splunk app install app_package.spl

/opt/splunk/bin/splunk install app app_package.spl