Getting Data In

How can I make the index from the cluster visible on the heavy forwarder so I can select it in the script?

FelixLeh
Contributor

Hello Community,

I'm currently trying to configure the Splunk Add-on for Microsoft Azure.
The Addon is installed on the Heavy Forwarder in my Environment and my goal is to forward the Data from the API to an Index in the Indexer Cluster. 
The Problem I'm having is that the configuration of the App only accepts Indexes that are visible locally on the machine. Since Indexes, that are configured through the _cluster, don't show up in the local index list, I am not able to choose it. If I write the index into the config anyway the App outputs the Status=false and doesn't pull from the API.

My Question now is: 
How can I make the Index from the Cluster visible on the Heavy Forwarder so I can select it in the Script?
Or if there is any other way to forward the Data from the App that I have missed?


Any advice or hints to documentation I might have missed are appreciated! 

Labels (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Use the UI on the HF to add the index name.

Better: use the same app on the HF that you uploaded to Splunk Cloud to create your indexes.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Use the UI on the HF to add the index name.

Better: use the same app on the HF that you uploaded to Splunk Cloud to create your indexes.

---
If this reply helps you, Karma would be appreciated.
0 Karma

FelixLeh
Contributor

Though I already tried that, it was the solution to my question after all.
So I'll mark your reply as the solution
During my Troubleshooting I figured out that the Problem I was having wasn't about the Index but with the authentication on the Azure Platform.

Get Updates on the Splunk Community!

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...