topic Re: Splunk Cloud Indexers in Splunk Cloud Platform

Splunk Cloud Indexers

briaca — Fri, 02 Apr 2021 15:14:23 GMT

I am working on configuring a Universal Forwarder to the SPLUNK Cloud. I have everything set up except the cloud is not receiving my data. I am getting a TCP port timeout. My question is where do I find the web address for the indexers to use to send my SPLUNK Cloud Data too. I have three different portals. One is the main portal (I think) and IDM portal and a ES portal. I am trying to send the data to IDM but unfortunately its just not working. Any help would be apprecieated.

Re: Splunk Cloud Indexers

richgalloway — Fri, 02 Apr 2021 15:54:20 GMT

None of those 3 "portals" are used by the UF. Go to the "Universal Forwarder" app on your Splunk Cloud search head and follow the instructions there. They will have you download an app to install on the UF which will configure the forwarder to talk to your cloud indexers.

Re: Splunk Cloud Indexers

briaca — Fri, 02 Apr 2021 16:49:23 GMT

The instructions state you have to configure and outputs.conf file and does not say what url to use. Nothing in the portal says what url to use. If I dont configure a file the splunkd log just says not outputs.conf file configured so it does not send the data anywhere.

Re: Splunk Cloud Indexers

richgalloway — Fri, 02 Apr 2021 19:55:43 GMT

The URL is in the file you downloaded from your Splunk Cloud SH. Not just the URL, either, the ENTIRE outputs.conf file. Just install the downloaded app on the forwarder and restart it. There's no need for configuration - that last step is bogus.