Searched data on HF to be sent to the IDX cluster

[Muralidhar_K]

Hello All,

I have an LDAPsearch app installed in one of the onprem Heavy Forwarders and I need to index the search out put into an index we have created. Our IDX and SH are on splunk cloud.

Would appreciate all the suggestions

Thanks in advance.

Murali

[Richfez · Accepted solution]

Ah, so you have that part.

The HF does not need to be able to see the indexes if the outputs are set up correctly.

You can use, at the end of your existing ldapsearch -

...
| collect <indexname>

 Which should just tuck that data into the index you name there.

Again, as long as the index exists on the indexer, your HF doesn't need to "see" the index.  It should "just work". 

Which brings up the point that if it doesn't work, I'd suspect your forwarding to your cloud is not actually set up right, but that's a different issue.  🙂

[Muralidhar_K]

Thank you @Richfez , That worked for me.

I really appreciate your quick response and love this community, it always give me answers.

[Richfez]

OK, so here's the steps:

https://docs.splunk.com/Documentation/Forwarder/9.2.1/Forwarder/ConfigSCUFCredentials#Install_the_fo...

It's strange that those instructions are not to be found at the Splunk Cloud Forwarder manual, but I've sent in some feedback on that and hopefully they'll make the above-linked instructions easier to find.

Happy Splunking, and if you found this useful then karma would be appreciated!

-Rich

[Muralidhar_K]

Hello @Richfez 

Thank you for the quick response.

We have HF configured and is forwarding the data to the IDX.

My scenario is, We have installed LDAPSearch app in the HF, We are able to run LDAP searches on the HF Web UI. we want to index those output in a an index we have created in the splunk cloud. 

I was thinking that ill create the report as search and add the action to log those events, but that did not work as it HF is not able to see the indexes.

I am looking for any way to achieve that.

Thanks

Murali