Hello Community,
I'm currently trying to configure the Splunk Add-on for Microsoft Azure.
The Addon is installed on the Heavy Forwarder in my Environment and my goal is to forward the Data from the API to an Index in the Indexer Cluster.
The Problem I'm having is that the configuration of the App only accepts Indexes that are visible locally on the machine. Since Indexes, that are configured through the _cluster, don't show up in the local index list, I am not able to choose it. If I write the index into the config anyway the App outputs the Status=false and doesn't pull from the API.
My Question now is:
How can I make the Index from the Cluster visible on the Heavy Forwarder so I can select it in the Script?
Or if there is any other way to forward the Data from the App that I have missed?
Any advice or hints to documentation I might have missed are appreciated!
Use the UI on the HF to add the index name.
Better: use the same app on the HF that you uploaded to Splunk Cloud to create your indexes.
Use the UI on the HF to add the index name.
Better: use the same app on the HF that you uploaded to Splunk Cloud to create your indexes.
Though I already tried that, it was the solution to my question after all.
So I'll mark your reply as the solution
During my Troubleshooting I figured out that the Problem I was having wasn't about the Index but with the authentication on the Azure Platform.