https://community.splunk.com/t5/Deployment-Architecture/Unable-to-forward-data-to-Splunk-Cloud-Instance/m-p/574693#M25035 <P>hi,</P><P>I have a local server on my network and would like to send data from this local host to the cloud instance. I have followed the instructions here,&nbsp;<A href="https://docs.splunk.com/Documentation/Forwarder/8.2.3/Forwarder/ConfigSCUFCredentials" target="_blank">https://docs.splunk.com/Documentation/Forwarder/8.2.3/Forwarder/ConfigSCUFCredentials</A>&nbsp;and installed the&nbsp;<SPAN>splunkclouduf.spl obtained from my cloud instance profile. However I seem to be getting the following errors:</SPAN></P><P>11-12-2021 13:56:53.874 +0800 WARN X509Verify [30879 HTTPDispatch] - X509 certificate (O=SplunkUser,CN=SplunkServerDefaultCert) should not be used, as it is issued by Splunk's own default Certificate Authority (CA). This puts your Splunk instance at very high-risk of the MITM attack. Either commercial-CA-signed or self-CA-signed certificates must be used; see: &lt;<A href="http://docs.splunk.com/Documentation/Splunk/latest/Security/Howtoself-signcertificates" target="_blank">http://docs.splunk.com/Documentation/Splunk/latest/Security/Howtoself-signcertificates</A>&gt;<BR />11-12-2021 13:56:53.901 +0800 INFO UiHttpListener [30942 WebuiStartup] - Web UI disabled in web.conf [settings]; not starting<BR />11-12-2021 13:56:54.039 +0800 INFO TcpOutputProc [30923 parsing] - _isHttpOutConfigured=NOT_CONFIGURED<BR />11-12-2021 13:56:54.040 +0800 ERROR TcpOutputProc [30923 parsing] - LightWeightForwarder/UniversalForwarder not configured. Please configure outputs.conf.<BR />11-12-2021 13:56:58.961 +0800 WARN TailReader [30932 tailreader0] - Could not send data to output queue (parsingQueue), retrying...</P><P>&nbsp;</P><P>I thought that once we deploy via the&nbsp;<SPAN>splunkclouduf.spl, we need not configure any outputs.conf file?</SPAN></P><P>&nbsp;</P><P><SPAN>Any assistance is greatly appreciated.</SPAN></P> Fri, 12 Nov 2021 06:42:47 GMT sairam109 2021-11-12T06:42:47Z https://community.splunk.com/t5/Deployment-Architecture/Unable-to-forward-data-to-Splunk-Cloud-Instance/m-p/574693#M25035 <P>hi,</P><P>I have a local server on my network and would like to send data from this local host to the cloud instance. I have followed the instructions here,&nbsp;<A href="https://docs.splunk.com/Documentation/Forwarder/8.2.3/Forwarder/ConfigSCUFCredentials" target="_blank">https://docs.splunk.com/Documentation/Forwarder/8.2.3/Forwarder/ConfigSCUFCredentials</A>&nbsp;and installed the&nbsp;<SPAN>splunkclouduf.spl obtained from my cloud instance profile. However I seem to be getting the following errors:</SPAN></P><P>11-12-2021 13:56:53.874 +0800 WARN X509Verify [30879 HTTPDispatch] - X509 certificate (O=SplunkUser,CN=SplunkServerDefaultCert) should not be used, as it is issued by Splunk's own default Certificate Authority (CA). This puts your Splunk instance at very high-risk of the MITM attack. Either commercial-CA-signed or self-CA-signed certificates must be used; see: &lt;<A href="http://docs.splunk.com/Documentation/Splunk/latest/Security/Howtoself-signcertificates" target="_blank">http://docs.splunk.com/Documentation/Splunk/latest/Security/Howtoself-signcertificates</A>&gt;<BR />11-12-2021 13:56:53.901 +0800 INFO UiHttpListener [30942 WebuiStartup] - Web UI disabled in web.conf [settings]; not starting<BR />11-12-2021 13:56:54.039 +0800 INFO TcpOutputProc [30923 parsing] - _isHttpOutConfigured=NOT_CONFIGURED<BR />11-12-2021 13:56:54.040 +0800 ERROR TcpOutputProc [30923 parsing] - LightWeightForwarder/UniversalForwarder not configured. Please configure outputs.conf.<BR />11-12-2021 13:56:58.961 +0800 WARN TailReader [30932 tailreader0] - Could not send data to output queue (parsingQueue), retrying...</P><P>&nbsp;</P><P>I thought that once we deploy via the&nbsp;<SPAN>splunkclouduf.spl, we need not configure any outputs.conf file?</SPAN></P><P>&nbsp;</P><P><SPAN>Any assistance is greatly appreciated.</SPAN></P> Fri, 12 Nov 2021 06:42:47 GMT https://community.splunk.com/t5/Deployment-Architecture/Unable-to-forward-data-to-Splunk-Cloud-Instance/m-p/574693#M25035 sairam109 2021-11-12T06:42:47Z https://community.splunk.com/t5/Deployment-Architecture/Unable-to-forward-data-to-Splunk-Cloud-Instance/m-p/574709#M25037 Hi<BR />You are running UF as a splunk user and also that splunkclouduf.spl are installed and owner by this user?<BR />r. Ismo Fri, 12 Nov 2021 08:19:01 GMT https://community.splunk.com/t5/Deployment-Architecture/Unable-to-forward-data-to-Splunk-Cloud-Instance/m-p/574709#M25037 isoutamo 2021-11-12T08:19:01Z https://community.splunk.com/t5/Deployment-Architecture/Unable-to-forward-data-to-Splunk-Cloud-Instance/m-p/574718#M25038 <P>Hi Ismo,</P><P>Nice to e-meet you <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span> Thanks for responding to my query.</P><P>It appears I might have somehow messed up the installation using the spl credential file. I just did a reinstall and seems to be working fine now. Thanks! Apologies for the inconvenience!&nbsp;</P> Fri, 12 Nov 2021 09:19:25 GMT https://community.splunk.com/t5/Deployment-Architecture/Unable-to-forward-data-to-Splunk-Cloud-Instance/m-p/574718#M25038 sairam109 2021-11-12T09:19:25Z https://community.splunk.com/t5/Deployment-Architecture/Unable-to-forward-data-to-Splunk-Cloud-Instance/m-p/574747#M25040 Nice to hear that it works for you. Happy splunking Fri, 12 Nov 2021 14:42:03 GMT https://community.splunk.com/t5/Deployment-Architecture/Unable-to-forward-data-to-Splunk-Cloud-Instance/m-p/574747#M25040 isoutamo 2021-11-12T14:42:03Z