Getting Data In

How can I make the index from the cluster visible on the heavy forwarder so I can select it in the script?

FelixLeh
Contributor

Hello Community,

I'm currently trying to configure the Splunk Add-on for Microsoft Azure.
The Addon is installed on the Heavy Forwarder in my Environment and my goal is to forward the Data from the API to an Index in the Indexer Cluster. 
The Problem I'm having is that the configuration of the App only accepts Indexes that are visible locally on the machine. Since Indexes, that are configured through the _cluster, don't show up in the local index list, I am not able to choose it. If I write the index into the config anyway the App outputs the Status=false and doesn't pull from the API.

My Question now is: 
How can I make the Index from the Cluster visible on the Heavy Forwarder so I can select it in the Script?
Or if there is any other way to forward the Data from the App that I have missed?


Any advice or hints to documentation I might have missed are appreciated! 

Labels (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Use the UI on the HF to add the index name.

Better: use the same app on the HF that you uploaded to Splunk Cloud to create your indexes.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Use the UI on the HF to add the index name.

Better: use the same app on the HF that you uploaded to Splunk Cloud to create your indexes.

---
If this reply helps you, Karma would be appreciated.
0 Karma

FelixLeh
Contributor

Though I already tried that, it was the solution to my question after all.
So I'll mark your reply as the solution
During my Troubleshooting I figured out that the Problem I was having wasn't about the Index but with the authentication on the Azure Platform.

Get Updates on the Splunk Community!

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...