Getting Data In

Forwarding on-prem data to splunk cloud with universal forwarder

mrsnrub
Engager

We have a managed splunk cloud tenant. I am trying to set up forwarding on on-prem server logs to splunk cloud. I've been able to successfully do this by installing the universal forwarder application on the servers and configuring inputs.conf. We have no deployment server. Our setup is on-prem server directly to splunk cloud over port 9997.

The issue I have is that the default splunk CA cert is being used and there are warnings in the splunkd log file saying I should another cert but I can't find any useful info in the docs about how to go about this. From what I've been able to find out, the data is encrypted going out to splunk cloud but anyone with the cert could decrypt it as it comes with every forwarder installation.

Has anyone any experience of setting up proper TLS for universal forwarders connecting directly to splunk cloud?

For reference, currently testing on Windows Servers but will need to forward some Linux logs at some point too.

Labels (1)
Get Updates on the Splunk Community!

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...