Getting Data In

Forwarding on-prem data to splunk cloud with universal forwarder

mrsnrub
Engager

We have a managed splunk cloud tenant. I am trying to set up forwarding on on-prem server logs to splunk cloud. I've been able to successfully do this by installing the universal forwarder application on the servers and configuring inputs.conf. We have no deployment server. Our setup is on-prem server directly to splunk cloud over port 9997.

The issue I have is that the default splunk CA cert is being used and there are warnings in the splunkd log file saying I should another cert but I can't find any useful info in the docs about how to go about this. From what I've been able to find out, the data is encrypted going out to splunk cloud but anyone with the cert could decrypt it as it comes with every forwarder installation.

Has anyone any experience of setting up proper TLS for universal forwarders connecting directly to splunk cloud?

For reference, currently testing on Windows Servers but will need to forward some Linux logs at some point too.

Labels (1)
Get Updates on the Splunk Community!

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...

Five Subtly Different Ways of Adding Manual Instrumentation in Java

You can find the code of this example on GitHub here. Please feel free to star the repository to keep in ...

New Splunk APM Enhancements Help Troubleshoot Your MySQL and NoSQL Databases Faster

Splunk Observability has two new enhancements to make it quicker and easier to troubleshoot slow or frequently ...