topic Re: Splunk Cloud Trial only shows 'HTTP Event Collector' as Data Input option in Getting Data In

Splunk Cloud Trial only shows 'HTTP Event Collector' as Data Input option

bluperfsplunkpo — Fri, 05 Jun 2020 22:02:38 GMT

I am trying to test Scripted Input according to steps mentioned here -
docs splunk com /Documentation/SplunkCloud/8.0.2004/Data/Getdatafromscriptedinputs

The problem is that trial instance only shows HTTP Event Collector

What am I doing wrong? Or am I expecting something that Trial instance doesn't provide?

Thanks in advance!

Re: Splunk Cloud Trial only shows 'HTTP Event Collector' as Data Input option

richgalloway — Fri, 22 May 2020 18:11:12 GMT

Splunk Cloud does not support scripted inputs. To use scripted inputs, you must define them in an on-prem heavy forwarder.
There's an exception for inputs from cloud-based sources, but I'm not sure the trial version supports IDM (Inputs Data Manager).

Re: Splunk Cloud Trial only shows 'HTTP Event Collector' as Data Input option

bluperfsplunkpo — Fri, 22 May 2020 19:32:25 GMT

Thanks @richgalloway for the quick response! Just one follow-up question -

Is there any alternate way to index response from REST API?

One approach I see is with Splunk Enterprise + REST API Modular Input kind of solution
https://splunkbase.splunk.com/app/1546/#/overview

I am reasonably new to Splunk so if my question is not well-formed apologies in advance.

Re: Splunk Cloud Trial only shows 'HTTP Event Collector' as Data Input option

richgalloway — Fri, 22 May 2020 20:07:52 GMT

Modular inputs and scripted inputs are fraternal twins. Both require heavy forwarders to work with Splunk Cloud.

Re: Splunk Cloud Trial only shows 'HTTP Event Collector' as Data Input option

bluperfsplunkpo — Fri, 22 May 2020 22:42:29 GMT

Thanks again. This helped a lot!