topic How to forward data from Universal Forwarder into online sandbox instance in Getting Data In

How to forward data from Universal Forwarder into online sandbox instance

Nicholas_Key — Sun, 26 Oct 2014 22:33:19 GMT

Here are the steps to configure your Universal Forwarder to forward events to your online sandbox instance:

Enable receiver in your online sandbox instance in https://prd-something-something.splunk6.splunktrial.com/en-US/manager/search/data/inputs/tcp/cooked
Then configure your Universal Forwarder with the following commands:

./splunk add forward-server input-prd-something-something.splunk6.splunktrial.com:9997
./splunk add monitor
Now perform a search and you'll be able to see some events in your online sandbox instance

Re: How to forward data from Universal Forwarder into online sandbox instance

martin_mueller — Mon, 27 Oct 2014 17:00:31 GMT

I'd say the question contains all the steps necessary, thanks Nick!

Re: How to forward data from Universal Forwarder into online sandbox instance

Nicholas_Key — Mon, 27 Oct 2014 17:18:12 GMT

You are welcome! Please try out the steps and let me know if they aren't working.

Re: How to forward data from Universal Forwarder into online sandbox instance

martin_mueller — Mon, 27 Oct 2014 20:08:06 GMT

Can't do that, US/Canada only 😛

Re: How to forward data from Universal Forwarder into online sandbox instance

ryoung_splunk — Wed, 14 Jan 2015 16:03:54 GMT

Since early December 2014 the steps to use a forwarder in the sandbox have changed. To forward data to a sandbox you can use Universal Forwarder App available in Splunk Online Sandbox. The Universal Forwarder App includes the information and credentials necessary to download, install, and authorize you to forward data to Splunk Online Sandbox. After you sign in to Splunk Online Sandbox, choose Universal Forwarder from the Apps menu, and follow the Universal Forwarder app instructions.

Re: How to forward data from Universal Forwarder into online sandbox instance

DelProfundo — Tue, 27 Jan 2015 09:54:35 GMT

Not true. Many places say "just download the universal forwarder and the app and install" does not work. Still errors out .

01-27-2015 19:52:39.782 +1000 ERROR TcpOutputFd - Read error. An existing connection was forcibly closed by the remote host.
01-27-2015 19:52:40.942 +1000 INFO TcpOutputProc - Connected to idx=54.84.49.180:9997 using ACK.
01-27-2015 19:52:47.265 +1000 INFO TailingProcessor - Could not send data to output queue (parsingQueue), retrying...