Getting Data In
Highlighted

How do we define collections.conf in SplunkCloud?

Contributor

Creating Lookup Definition (transforms stanza) can be done on Splunk Web UI. But since we need to point a kv definition to a collections.conf, we must have that stanza in collections.conf. How do we define collections.conf in SplunkCloud? Thanks in advance.

0 Karma
Highlighted

Re: How do we define collections.conf in SplunkCloud?

Esteemed Legend

You have to either deploy an app that is cloud vetted which contains one OR to create one just for you, you must open a support case.

View solution in original post

0 Karma
Highlighted

Re: How do we define collections.conf in SplunkCloud?

Contributor

sucks man 😞

Highlighted

Re: How do we define collections.conf in SplunkCloud?

Contributor

This problem can be solved if you have Lookup Editor installed in your SplunkCloud search head. In that app, there's a way to configure a new KV Lookup and that includes taking care of collections-conf name.

0 Karma