Getting Data In

How to forward data from Universal Forwarder into online sandbox instance

Nicholas_Key
Splunk Employee
Splunk Employee

Here are the steps to configure your Universal Forwarder to forward events to your online sandbox instance:

  1. Enable receiver in your online sandbox instance in https://prd-something-something.splunk6.splunktrial.com/en-US/manager/search/data/inputs/tcp/cooked
  2. Then configure your Universal Forwarder with the following commands:

    ./splunk add forward-server input-prd-something-something.splunk6.splunktrial.com:9997
    ./splunk add monitor
    Now perform a search and you'll be able to see some events in your online sandbox instance

1 Solution

martin_mueller
SplunkTrust
SplunkTrust

I'd say the question contains all the steps necessary, thanks Nick!

View solution in original post

ryoung_splunk
Splunk Employee
Splunk Employee

Since early December 2014 the steps to use a forwarder in the sandbox have changed. To forward data to a sandbox you can use Universal Forwarder App available in Splunk Online Sandbox. The Universal Forwarder App includes the information and credentials necessary to download, install, and authorize you to forward data to Splunk Online Sandbox. After you sign in to Splunk Online Sandbox, choose Universal Forwarder from the Apps menu, and follow the Universal Forwarder app instructions.

DelProfundo
Explorer

Not true. Many places say "just download the universal forwarder and the app and install" does not work. Still errors out .

01-27-2015 19:52:39.782 +1000 ERROR TcpOutputFd - Read error. An existing connection was forcibly closed by the remote host.
01-27-2015 19:52:40.942 +1000 INFO TcpOutputProc - Connected to idx=54.84.49.180:9997 using ACK.
01-27-2015 19:52:47.265 +1000 INFO TailingProcessor - Could not send data to output queue (parsingQueue), retrying...

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

I'd say the question contains all the steps necessary, thanks Nick!

martin_mueller
SplunkTrust
SplunkTrust

Can't do that, US/Canada only 😛

0 Karma

Nicholas_Key
Splunk Employee
Splunk Employee

You are welcome! Please try out the steps and let me know if they aren't working.

0 Karma
Get Updates on the Splunk Community!

Splunk is Nurturing Tomorrow’s Cybersecurity Leaders Today

Meet Carol Wright. She leads the Splunk Academic Alliance program at Splunk. The Splunk Academic Alliance ...

Part 2: A Guide to Maximizing Splunk IT Service Intelligence

Welcome to the second segment of our guide. In Part 1, we covered the essentials of getting started with ITSI ...

Part 1: A Guide to Maximizing Splunk IT Service Intelligence

As modern IT environments continue to grow in complexity and speed, the ability to efficiently manage and ...