How to set up TCP monitoring in Splunk Light Cloud?

teamgrowthhacke — Tue, 12 Jul 2016 03:33:16 GMT

Hello,

I am an experienced Splunk Enterprise user and administrator using Splunk Cloud Light for the first time.

I am trying to follow the directions here to set up monitoring a syslog stream via TCP to monitor a Heroku instance.
http://docs.splunk.com/Documentation/SplunkLight/6.4.0/GettingStarted/Monitornetworkports

The process is described in a Splunk Blog entry here: http://blogs.splunk.com/2014/04/10/splunking-heroku/

Clicking Add New next to TCP on this screen

Takes me to a selection screen for Forwarders, but I simply need the monitoring not the forwarder configuration.

Also following the directions on this screen doesn't show a TCP option (only HTTP):
https://my-instance.cloud.splunk.com/en-US/manager/search/adddata/selectsource?input_mode=1

This person also seemed to encounter the same UI bug as me, but he is actually trying to configure a forwarder whereas I am not. https://answers.splunk.com/answers/390942/how-to-configure-a-forwarder-to-listen-on-tcpudp-f.html

Please advise.

Thank you,
John

Re: How to set up TCP monitoring in Splunk Light Cloud?

dkoshe_splunk — Tue, 12 Jul 2016 20:44:07 GMT

Hello John,

In Cloud deployment, TCP monitoring is not supported.
You options are to either to use HTTP Event Collector, (I believe hiroku supports HTTPS data drains).
Or, you can host a Splunk Forwarder, and enable TCP input for receiving hiroku data as syslog (which will then route it to your Splunk Light cloud instance).

HTH,
-Dhananjay

topic Re: How to set up TCP monitoring in Splunk Light Cloud? in Getting Data In

How to set up TCP monitoring in Splunk Light Cloud?

Re: How to set up TCP monitoring in Splunk Light Cloud?