All Apps and Add-ons

Possible to forward results from Splunk for Asset Discovery App to Splunk Cloud?

cjbischoffmck
New Member

Would it be possible to run this application in the following fashion -

On local/on-premise machines perform the scanning - then using the local forwarder to send results to Splunk in the Cloud (where the app is installed?

0 Karma
1 Solution

mw
Splunk Employee
Splunk Employee

Yes it is. It's really just a simple matter of configuring the universal forwarder (your scanner) to forward to your cloud-based server (possibly through an intermediate forwarder). Really, there are a number of options for deployment topologies, but certainly a hybrid on-prem/cloud topology in a general sense is one of them. Here's a link to the forwarder documentation: http://docs.splunk.com/Documentation/Splunk/6.1.2/Forwarding/Aboutforwardingandreceivingdata .

I would also encourage you to get in touch with sales@splunk.com to engage your local sales team who can assist you in determining the correct architecture for your requirements.

These links may also be of interest:
http://www.splunk.com/web_assets/pdfs/secure/Splunk_for_Amazon_Web_Services.pdf
http://www.splunk.com/view/cloud/SP-CAAAG58

View solution in original post

0 Karma

mw
Splunk Employee
Splunk Employee

Yes it is. It's really just a simple matter of configuring the universal forwarder (your scanner) to forward to your cloud-based server (possibly through an intermediate forwarder). Really, there are a number of options for deployment topologies, but certainly a hybrid on-prem/cloud topology in a general sense is one of them. Here's a link to the forwarder documentation: http://docs.splunk.com/Documentation/Splunk/6.1.2/Forwarding/Aboutforwardingandreceivingdata .

I would also encourage you to get in touch with sales@splunk.com to engage your local sales team who can assist you in determining the correct architecture for your requirements.

These links may also be of interest:
http://www.splunk.com/web_assets/pdfs/secure/Splunk_for_Amazon_Web_Services.pdf
http://www.splunk.com/view/cloud/SP-CAAAG58

View solution in original post

0 Karma

cjbischoffmck
New Member

Installed on the local machine (syslog server with Splunk Forwarder installed) Performed post configuration - restarted Splunk. How do I check if the inputs.conf is correct?

$SPLUNK_HOME/bin/splunk list monitor doesnt show the script to be executed - just show the files being monitored.

0 Karma

mw
Splunk Employee
Splunk Employee

That's correct. On-prem, each "scanner" would have the Splunk universal forwarder installed with forwarding configured, as well as the Asset Discovery app with its scripted inputs enabled. The cloud would consist of your Splunk server which also has the same app installed and "receiving" enabled.

0 Karma

cjbischoffmck
New Member

I am guessing I will need to install the app both cloud and on-premise. Downloading the application to see the internals - thanks

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!