https://community.splunk.com/t5/Splunk-Cloud-Platform/Splunk-Heavy-Forwarded-to-Splunk-Cloud/m-p/547107#M616 <P>Maybe I'm still missing something but i've read over that documentation and noticed that it still doesn't specify how to forward logs from HF to splunk cloud.&nbsp; One notable thing is it doesn't say what the URL:PORT to use...&nbsp;&nbsp;</P> Wed, 07 Apr 2021 21:09:52 GMT JohnACERTUS 2021-04-07T21:09:52Z https://community.splunk.com/t5/Splunk-Cloud-Platform/Splunk-Heavy-Forwarded-to-Splunk-Cloud/m-p/547093#M614 <P>Am I going crazy or is there legit not documentation on setting up a HF to point and send data to our cloud instance?&nbsp;&nbsp;</P><P>&nbsp;</P><P>All the documentation I am finding is centered around a 100% on-prem setup.&nbsp;&nbsp;</P><P>&nbsp;</P><P>Anyone have any luck with this?</P> Wed, 07 Apr 2021 19:47:33 GMT https://community.splunk.com/t5/Splunk-Cloud-Platform/Splunk-Heavy-Forwarded-to-Splunk-Cloud/m-p/547093#M614 JohnACERTUS 2021-04-07T19:47:33Z https://community.splunk.com/t5/Splunk-Cloud-Platform/Splunk-Heavy-Forwarded-to-Splunk-Cloud/m-p/547101#M615 <P>It's documented.&nbsp; See <A href="https://docs.splunk.com/Documentation/SplunkCloud/8.1.2101/Data/UsingforwardingagentsCloud" target="_blank">https://docs.splunk.com/Documentation/SplunkCloud/8.1.2101/Data/UsingforwardingagentsCloud</A> or <A href="https://docs.splunk.com/Documentation/Forwarder/latest/Forwarder/HowtoforwarddatatoSplunkCloud" target="_blank">https://docs.splunk.com/Documentation/Forwarder/latest/Forwarder/HowtoforwarddatatoSplunkCloud</A></P><P>You also can go to the "Universal Forwarder" app in your Splunk Cloud instance for instructions.</P> Wed, 07 Apr 2021 20:49:04 GMT https://community.splunk.com/t5/Splunk-Cloud-Platform/Splunk-Heavy-Forwarded-to-Splunk-Cloud/m-p/547101#M615 richgalloway 2021-04-07T20:49:04Z https://community.splunk.com/t5/Splunk-Cloud-Platform/Splunk-Heavy-Forwarded-to-Splunk-Cloud/m-p/547107#M616 <P>Maybe I'm still missing something but i've read over that documentation and noticed that it still doesn't specify how to forward logs from HF to splunk cloud.&nbsp; One notable thing is it doesn't say what the URL:PORT to use...&nbsp;&nbsp;</P> Wed, 07 Apr 2021 21:09:52 GMT https://community.splunk.com/t5/Splunk-Cloud-Platform/Splunk-Heavy-Forwarded-to-Splunk-Cloud/m-p/547107#M616 JohnACERTUS 2021-04-07T21:09:52Z https://community.splunk.com/t5/Splunk-Cloud-Platform/Splunk-Heavy-Forwarded-to-Splunk-Cloud/m-p/547109#M617 <P>I've done this&nbsp;</P><P>"If you want to set up a heavy forwarder to send data in Splunk Cloud, request a deployment server license from Splunk support to allow them to carry out functions above and beyond what is covered by the forwarder license. See&nbsp;Data collection&nbsp;in the&nbsp;Splunk Cloud Service Description."</P><P>On the data collection link, can you point to me where it specifies?&nbsp;</P> Wed, 07 Apr 2021 21:12:38 GMT https://community.splunk.com/t5/Splunk-Cloud-Platform/Splunk-Heavy-Forwarded-to-Splunk-Cloud/m-p/547109#M617 JohnACERTUS 2021-04-07T21:12:38Z https://community.splunk.com/t5/Splunk-Cloud-Platform/Splunk-Heavy-Forwarded-to-Splunk-Cloud/m-p/547122#M619 <P>Follow the instructions in the second link provided.</P> Wed, 07 Apr 2021 22:21:08 GMT https://community.splunk.com/t5/Splunk-Cloud-Platform/Splunk-Heavy-Forwarded-to-Splunk-Cloud/m-p/547122#M619 richgalloway 2021-04-07T22:21:08Z https://community.splunk.com/t5/Splunk-Cloud-Platform/Splunk-Heavy-Forwarded-to-Splunk-Cloud/m-p/547204#M620 <P>Are there windows version instructions for this page?&nbsp;</P><P>&nbsp;</P><P><A href="https://docs.splunk.com/Documentation/Forwarder/8.1.3/Forwarder/ConfigSCUFCredentials" target="_blank">Install and configure the Splunk Cloud universal forwarder credentials package - Splunk Documentation</A></P> Thu, 08 Apr 2021 13:58:45 GMT https://community.splunk.com/t5/Splunk-Cloud-Platform/Splunk-Heavy-Forwarded-to-Splunk-Cloud/m-p/547204#M620 JohnACERTUS 2021-04-08T13:58:45Z https://community.splunk.com/t5/Splunk-Cloud-Platform/Splunk-Heavy-Forwarded-to-Splunk-Cloud/m-p/547239#M621 <P>Splunk is a very Linux-centric company so Windows-oriented instructions are not as common as they could be. Most of the time, all a Windows admin needs to do is change file path delimiters, but every now and then a Linux command has to be replaced with a Windows equivalent.&nbsp;&nbsp;</P><P>In this case, I use 7-zip in place of tar.&nbsp; Also, Ubuntu on Windows has tar available.</P> Thu, 08 Apr 2021 16:59:54 GMT https://community.splunk.com/t5/Splunk-Cloud-Platform/Splunk-Heavy-Forwarded-to-Splunk-Cloud/m-p/547239#M621 richgalloway 2021-04-08T16:59:54Z