Getting Data In

Forwarding on-prem data to splunk cloud with universal forwarder


We have a managed splunk cloud tenant. I am trying to set up forwarding on on-prem server logs to splunk cloud. I've been able to successfully do this by installing the universal forwarder application on the servers and configuring inputs.conf. We have no deployment server. Our setup is on-prem server directly to splunk cloud over port 9997.

The issue I have is that the default splunk CA cert is being used and there are warnings in the splunkd log file saying I should another cert but I can't find any useful info in the docs about how to go about this. From what I've been able to find out, the data is encrypted going out to splunk cloud but anyone with the cert could decrypt it as it comes with every forwarder installation.

Has anyone any experience of setting up proper TLS for universal forwarders connecting directly to splunk cloud?

For reference, currently testing on Windows Servers but will need to forward some Linux logs at some point too.

Labels (1)
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...