Getting Data In

How to forward data from Universal Forwarder into online sandbox instance

Nicholas_Key
Splunk Employee
Splunk Employee

Here are the steps to configure your Universal Forwarder to forward events to your online sandbox instance:

  1. Enable receiver in your online sandbox instance in https://prd-something-something.splunk6.splunktrial.com/en-US/manager/search/data/inputs/tcp/cooked
  2. Then configure your Universal Forwarder with the following commands:

    ./splunk add forward-server input-prd-something-something.splunk6.splunktrial.com:9997
    ./splunk add monitor
    Now perform a search and you'll be able to see some events in your online sandbox instance

1 Solution

martin_mueller
SplunkTrust
SplunkTrust

I'd say the question contains all the steps necessary, thanks Nick!

View solution in original post

ryoung_splunk
Splunk Employee
Splunk Employee

Since early December 2014 the steps to use a forwarder in the sandbox have changed. To forward data to a sandbox you can use Universal Forwarder App available in Splunk Online Sandbox. The Universal Forwarder App includes the information and credentials necessary to download, install, and authorize you to forward data to Splunk Online Sandbox. After you sign in to Splunk Online Sandbox, choose Universal Forwarder from the Apps menu, and follow the Universal Forwarder app instructions.

DelProfundo
Explorer

Not true. Many places say "just download the universal forwarder and the app and install" does not work. Still errors out .

01-27-2015 19:52:39.782 +1000 ERROR TcpOutputFd - Read error. An existing connection was forcibly closed by the remote host.
01-27-2015 19:52:40.942 +1000 INFO TcpOutputProc - Connected to idx=54.84.49.180:9997 using ACK.
01-27-2015 19:52:47.265 +1000 INFO TailingProcessor - Could not send data to output queue (parsingQueue), retrying...

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

I'd say the question contains all the steps necessary, thanks Nick!

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Can't do that, US/Canada only 😛

0 Karma

Nicholas_Key
Splunk Employee
Splunk Employee

You are welcome! Please try out the steps and let me know if they aren't working.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!