topic Splunk Cloud Data Input in Deployment Architecture

Splunk Cloud Data Input

mohsplunking — Fri, 17 Jan 2025 11:54:21 GMT

Hello Team,

When an organization is having Hybrid deployment , so they using Splunk cloud service too, can data be sent directly to Splunk Cloud, for example there is a SaaS application which only has an option to send logs over syslog , how can this be achieved while using Splunk cloud. What are the options for Data input here. If someone can elaborate.

Thanking you in advance,

regards,

Moh

Re: Splunk Cloud Data Input

isoutamo — Fri, 17 Jan 2025 12:12:29 GMT

you can send or pull data into SCP. It’s totally depends on what is your SaaS system where you try to get this data. Currently quite many SaaS can send data via HEC to splunk. Another option is that they have REST api where you can query that data via modular inputs. Time by time there could be some other options too.

You should start with asking this from your SaaS vendor if they have any integration to Splunk. Also you could use google to found any other documentation for it.

r. Ismo

Re: Splunk Cloud Data Input

kiran_panchavat — Fri, 17 Jan 2025 12:14:20 GMT

@mohsplunking

Set up a syslog forwarder to receive data from the SaaS application and then forward it to the Splunk Cloud. You can send data via HEC token also.

Re: Splunk Cloud Data Input

scelikok — Fri, 17 Jan 2025 12:16:42 GMT

Hi @mohsplunking ,

You cannot send syslog data directly to Splunk Cloud. You must use a Splunk Universal Forwarder or Splunk Heavy Forwarder to ingest the UDP syslog and send it to Splunk Cloud.

You can see the documentation about syslog on Splunk Cloud below.

https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/HowSplunkEnterprisehandlessyslogdata

Re: Splunk Cloud Data Input

isoutamo — Fri, 17 Jan 2025 12:37:24 GMT

It’s exactly that way.

you need to understand your situation. Even there is some technical details mentioned you must understand the big picture, if you really want to utilize that data.
define your options
select best option
implement it

In real business You cannot start directly from step 4 if you want to get working solution with reasonable costs.