Getting Data In

Forwarding on-prem data to splunk cloud with universal forwarder

mrsnrub
Engager

We have a managed splunk cloud tenant. I am trying to set up forwarding on on-prem server logs to splunk cloud. I've been able to successfully do this by installing the universal forwarder application on the servers and configuring inputs.conf. We have no deployment server. Our setup is on-prem server directly to splunk cloud over port 9997.

The issue I have is that the default splunk CA cert is being used and there are warnings in the splunkd log file saying I should another cert but I can't find any useful info in the docs about how to go about this. From what I've been able to find out, the data is encrypted going out to splunk cloud but anyone with the cert could decrypt it as it comes with every forwarder installation.

Has anyone any experience of setting up proper TLS for universal forwarders connecting directly to splunk cloud?

For reference, currently testing on Windows Servers but will need to forward some Linux logs at some point too.

Labels (1)
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...