How to set up a heavy forwarder to forward data to Splunk Cloud?

[Dayane_tr]

I didn't find the cloud documentation very clear...

Do I need to install splunk enterprise separately to have heavy for warder and then configure my splunk cloud license?

Do I need to ask splunk support for an enterprise license?
After all, how do I configure a heavy forwarder? And what address do I put in Universal forwarder? From the IP or hostname cloud?

I've read the following threads and it gets more and more confused:

https://www.splunk.com/en_us/resources/videos/splunk-cloud-tutorial.html

https://community.splunk.com/t5/Getting-Data-In/How-to-set-up-a-heavy-forwarder-to-forward-data-to-S...

https://docs.splunk.com/Documentation/SplunkCloud/8.2.2202/Admin/WindowsGDI  Step2

Can you help me please?

Regards

[Dayane_tr]

Hello @PickleRick 

Thank you very much for your help.

The situation is a little more complex when it comes to activating SPLUNK support here in Brazil. My client switched support and it's the first time I have to “help” with “simple architectural design” in an environment that I didn't set up. The customer does not have access to the panel for us to open a ticket, that's why so many questions. You helped me a lot around here.

Regards.

Day 🙂

[gcusello]

Hi @Dayane_tr,

I don't think that you can install an UF on Fortigate, and I'm not sure on SentinelOne because they are closed systems.

Usually these kind of systems send theyr logs by syslog to a Splunk server (HF or UF).

Anyway, correct architecture is to have two HFs (better) or eventully two UFs with a Load Balancer in front  (eventually a DNS configuration) to distribute load and manage fail over of one of the two machines.

The App distributed by Splunk Cloud for the connection, must be installed on all machines that directly communicate with it, usually the two HFs or UFs used as concentrators.

All the other UFs must be configured to send their logs to the concentrators.

About Architecture, it isn't a thing that can be solved in Communty, you need the intervene of a Splunk Architect.

I hint to follow at least a course fo Splunk Admin and engage a Splunk Architect or a Splunk PS to design your architecture.

Ciao.

Giuseppe

[Dayane_tr]

Hi @gcusello 

Sorry if I bothered you with so many questions! This is a forum, and I believe I can ask as many questions as necessary to clear my doubts? Right?

When I referred to architecture...well, I asked for a simple drawing and not someone to do the work for me.m 🙂

Thank you very much for your attention and patience here. I found many different solutions with other kind colleagues on this issue. Success in your career.

Grazie Mille

D.

[PickleRick]

Sure thing. The community is for sharing the knowledge and that's what we're trying to do here.

It's just that sometimes we pass the level of details that we're effectively moving into what a qualified person should do on-site. Like sitting with you, getting the _detailed_ information about the infrastructure and desiging the proper solution. Because otherwise, without the full knowledge of your setup it's easy to misadvise and we wouldn't want that 🙂

[gcusello]

Hi @Dayane_tr,

don't worry, it's always a pleasure!

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated by all the Contributors 😉