https://community.splunk.com/t5/Getting-Data-In/Splunk-Cloud-How-do-data-configurations-get-specified-with-UF-s/m-p/674956#M112970 <P>Hi all,</P><P>&nbsp;</P><P>I am coming from Splunk on-prem so this is a bit confusing to me. I have looked at architectures regarding Splunk Cloud and can't understand how data configs are done when using Splunk Cloud. For example, let's say:</P><P>&nbsp;</P><P>- You have a UF on a machine that forwards data to Splunk Indexers (cloud), you are to make a custom sourcetype for this specific piece of data. Where would you define the parsing rules for this if you don't manage the Indexers. Furthermore if the data can be on-boarded with a TA, how would you install this TA onto the indexers to assist with onboarding (assuming no need for HF)</P><P>&nbsp;</P><P>&nbsp;</P><P>Any help would be appreciated, thanks!</P> Sun, 21 Jan 2024 14:38:29 GMT IAskALotOfQs 2024-01-21T14:38:29Z https://community.splunk.com/t5/Getting-Data-In/Splunk-Cloud-How-do-data-configurations-get-specified-with-UF-s/m-p/674956#M112970 <P>Hi all,</P><P>&nbsp;</P><P>I am coming from Splunk on-prem so this is a bit confusing to me. I have looked at architectures regarding Splunk Cloud and can't understand how data configs are done when using Splunk Cloud. For example, let's say:</P><P>&nbsp;</P><P>- You have a UF on a machine that forwards data to Splunk Indexers (cloud), you are to make a custom sourcetype for this specific piece of data. Where would you define the parsing rules for this if you don't manage the Indexers. Furthermore if the data can be on-boarded with a TA, how would you install this TA onto the indexers to assist with onboarding (assuming no need for HF)</P><P>&nbsp;</P><P>&nbsp;</P><P>Any help would be appreciated, thanks!</P> Sun, 21 Jan 2024 14:38:29 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-Cloud-How-do-data-configurations-get-specified-with-UF-s/m-p/674956#M112970 IAskALotOfQs 2024-01-21T14:38:29Z https://community.splunk.com/t5/Getting-Data-In/Splunk-Cloud-How-do-data-configurations-get-specified-with-UF-s/m-p/674969#M112971 <P>The cloud is managed by clever automation on Splunk's side so the apps you upload to Cloud land on indexers as well. So the proper way to define index-time props and transforms is to just make an app with those settings and install it on your Cloud instance.</P> Sun, 21 Jan 2024 19:12:38 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-Cloud-How-do-data-configurations-get-specified-with-UF-s/m-p/674969#M112971 PickleRick 2024-01-21T19:12:38Z