Cloud Setup

[wadekuhl]

How do I determine the server setting for my on-premise agent config trying to send data via HTTP from a Windows server to my new cloud instance? 

[gcusello]

Hi @wadekuhl ,

as also @richgalloway said, you have to download the add-on from your Splunk Cloud instance.

One addition hint: if you have many on premise systems (devices, pcs, servers, etc...), it's a best practice to have two Heavy Forwarders as concentrators of all the on-premise systems; in this way, you must open only the connections between these two systems and Splunk Cloud, instead of all systems.

In this case, you have to install the add-on only on these two systems and not on all systems.

Ciao.

Giuseppe

[wadekuhl]

Thank you for your replies.  I am looking to use this to monitor a Citrix environment with the Citrix Uber Agent  on both cloud and on-prem machines reporting to a Splunk Console and thus I figured the Cloud Splunk would be ideal.  
This is a relatively new product on the Citrix side so the documentation is not fully formed.  

The agent is configured via a .CONF file where the server URL and token are set but finding particulars on exactly what that will be gets glossed over in everything I've seen and the example in the file is only for an on-prem Splunk instance.

This likely won't help but at least you can see where I'm coming from 

Wade

[livehybrid]

Is there a particular reason you are looking to send out over HTTP Event Collector rather than the usual Splunk2Splunk approach using the settings provided in the Universal Forwarder app in your Splunk Cloud instance?
If you really do want to send over HTTPS instead then you will need to update the outputs.conf of your forwarder:

To configure your on-premise Splunk Universal Forwarder to send data via HTTP to your new cloud instance, 

First, create a HEC token in your cloud environment - For more info see the docs page.

Then, modify the outputs.conf file located in $SPLUNK_HOME/etc/system/local/ (or equivalent in your setup). You should define your cloud instance's endpoint here.
For example:

[httpout]
uri = https://http-inputs-<stackName>.splunkcloud.com:443
httpEventCollectorToken = <yourHECToken>

More info on HTTP Output from Splunk docs 

I hope this helps.

Will

[richgalloway]

All the settings you need are in the "Universal Forwarder" app on your cloud instance.  Open that app, click the green Download button, then install the downloaded file in the Universal Forwarder on your Windows server.

[livehybrid]

Is there a particular reason you are looking to send out over HTTP Event Collector rather than the usual Splunk2Splunk approach using the settings provided in the Universal Forwarder app in your Splunk Cloud instance?
If you really do want to send over HTTPS instead then you will need to update the outputs.conf of your forwarder:

To configure your on-premise Splunk Universal Forwarder to send data via HTTP to your new cloud instance, 

First, create a HEC token in your cloud environment - For more info see the docs page.

Then, modify the outputs.conf file located in $SPLUNK_HOME/etc/system/local/ (or equivalent in your setup). You should define your cloud instance's endpoint here.
For example:

[httpout]
uri = https://http-inputs-<stackName>.splunkcloud.com:443
httpEventCollectorToken = <yourHECToken>

More info on HTTP Output from Splunk docs 

I hope this helps.

Will

[wadekuhl]

I was able to get the details of my cloud instance by creating a new NetScaler data source that exposed the correct URL as one of it's fields.  I think this should work for me.

Appreciate everyone's help!

Wade