Splunk Cloud Data Input

[mohsplunking]

Hello Team,

When an organization is  having Hybrid deployment , so they using Splunk cloud service too, can data be sent directly to Splunk Cloud, for example there is a SaaS application which only has an option to send logs over syslog , how can this be achieved while using Splunk cloud. What are the options for Data input here. If someone can elaborate.

Thanking you in advance,

regards,

Moh

[scelikok]

Hi @mohsplunking ,

You cannot send syslog data directly to Splunk Cloud. You must use a Splunk Universal Forwarder or Splunk Heavy Forwarder to ingest the UDP syslog and send it to Splunk Cloud.

You can see the documentation about  syslog on Splunk Cloud below.

https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/HowSplunkEnterprisehandlessyslogdata

[isoutamo]

It’s exactly that way.

1. you need to understand your situation. Even there is some technical details mentioned you must understand the big picture, if you really want to utilize that data.
2. define your options
3. select best option
4. implement it

In real business You cannot start directly from step 4 if you want to get working solution with reasonable costs.

[kiran_panchavat]

@mohsplunking 

Set up a syslog forwarder to receive data from the SaaS application and then forward it to the Splunk Cloud. You can send data via HEC token also. 

[isoutamo]

Hi

you can send or pull data into SCP. It’s totally depends on what is your SaaS system where you try to get this data. Currently quite many SaaS can send data via HEC to splunk. Another option is that they have REST api where you can query that data via modular inputs. Time by time there could be some other options too.

You should start with asking this from your SaaS vendor if they have any integration to Splunk. Also you could use google to found any other documentation for it.

r. Ismo