topic Re: Unable To Forward Data To Splunk Cloud From Linux in Getting Data In

Unable To Forward Data To Splunk Cloud From Linux

tarunchawla28 — Mon, 18 Mar 2019 06:29:00 GMT

Under my free trial version of Splunk Cloud, I am trying to send data from linux instance to splunk cloud.
I created an EC2 and configured the Universal Forwarder over it by following this documentation

https://docs.splunk.com/Documentation/SplunkCloud/7.2.4/User/ForwardDataToSplunkCloudFromLinux

Following this doc, after setting the deploy poll on my linux instance(where universal forwarder is installed), I can see the IP of my instance under available host (Setting-> Add data-> forward) in my splunk cloud. I select this host and for configuring source in my splunk cloud, I select the file or directory say as /var/log/auth.log.

I can't see anything in my search even if I do * and select time as all time.

Re: Unable To Forward Data To Splunk Cloud From Linux

deepashri_123 — Mon, 18 Mar 2019 09:34:50 GMT

Hi tarunchawla28,

Have you enabled the receiver? Refer this link:
https://docs.splunk.com/Documentation/Splunk/7.2.4/AddMSWinCloud/EnableReceiver

Also in your search tab can u check index=* and run the query

Let me know if this helps!!

Re: Unable To Forward Data To Splunk Cloud From Linux

tarunchawla28 — Mon, 08 Apr 2019 05:44:37 GMT

Did the whole thing again. After some time, I got the data from my linux instance. Can't say why it took time.