Currently Splunk Sandbox DOES support forwarding data via Universal Forwarders.
On the other hand, raw UDP SYSLOG forwarding directly to the Sandbox (without a Universal Forwarder) is not supported. This is done for good reasons. To forward SYSLOG data from a host, a Universal Forwarder can be installed and configured to monitor and push local SYSLOG to the Sandbox.
Currently Splunk Sandbox DOES support forwarding data via Universal Forwarders.
On the other hand, raw UDP SYSLOG forwarding directly to the Sandbox (without a Universal Forwarder) is not supported. This is done for good reasons. To forward SYSLOG data from a host, a Universal Forwarder can be installed and configured to monitor and push local SYSLOG to the Sandbox.
It looks like Splunk Sandbox (which I believe is different than splunk storm or cloud) only supports uploading data via files. In the Splunk Sandbox instance I just spun up, the only "Add Data" option is to upload a file. I was also wanting to send some live SYSLOG from some of my devices up to the Sandbox, but it appears the only way to really do this is to log to your own server somewhere, take the log files, and then upload them to Sandbox.
Splunk sandbox is currently available off the front page of Splunk by clicking "Free Splunk" and then clicking the Free Online Sandbox link.
This is the direct link http://www.splunk.com/page/sign_up/cloudtrial?redirecturl=/getsplunk/cloudtrial&ac=test_modal_online...
This is correct. The online sandbox only supports file upload, not forwarding or monitoring.
Take a look at the Cisco Docs http://www.cisco.com/c/en/us/td/docs/security/asa/asa91/configuration/general/asa_91_general_config/...
After that you enable network inputs in Splunk http://docs.splunk.com/Documentation/Splunk/6.1.3/Data/Monitornetworkports
cheers, MuS
Login to splunkstorm.com, select your project, click the data tab, under network data click select, then click authorize your IP address - done
My cloud splunk must be missing a part of that then. Cant find that anywhere.
but because you were so keen and provided a lot of information, I was able to find the correct link http://docs.splunk.com/Documentation/Storm/latest/User/AdddataoverTCPorUDP
this includes a lot irony 😉
well you did not mention Splunk cloud at all 😉
the linked document doesnt cover splunk cloud.