How to forward data from Universal Forwarder into online sandbox instance

[Nicholas_Key]

Here are the steps to configure your Universal Forwarder to forward events to your online sandbox instance:

1. Enable receiver in your online sandbox instance in https://prd-something-something.splunk6.splunktrial.com/en-US/manager/search/data/inputs/tcp/cooked

2. Then configure your Universal Forwarder with the following commands:

   ./splunk add forward-server input-prd-something-something.splunk6.splunktrial.com:9997
   ./splunk add monitor
   Now perform a search and you'll be able to see some events in your online sandbox instance

[ryoung_splunk]

Since early December 2014 the steps to use a forwarder in the sandbox have changed. To forward data to a sandbox you can use Universal Forwarder App available in Splunk Online Sandbox. The Universal Forwarder App includes the information and credentials necessary to download, install, and authorize you to forward data to Splunk Online Sandbox. After you sign in to Splunk Online Sandbox, choose Universal Forwarder from the Apps menu, and follow the Universal Forwarder app instructions.

[DelProfundo]

Not true. Many places say "just download the universal forwarder and the app and install" does not work. Still errors out .

01-27-2015 19:52:39.782 +1000 ERROR TcpOutputFd - Read error. An existing connection was forcibly closed by the remote host.
01-27-2015 19:52:40.942 +1000 INFO TcpOutputProc - Connected to idx=54.84.49.180:9997 using ACK.
01-27-2015 19:52:47.265 +1000 INFO TailingProcessor - Could not send data to output queue (parsingQueue), retrying...

[martin_mueller · Accepted solution]

I'd say the question contains all the steps necessary, thanks Nick!

[martin_mueller]

Can't do that, US/Canada only 😛

[Nicholas_Key]

You are welcome! Please try out the steps and let me know if they aren't working.