Hello, I deployed a free trial of Splunk Cloud instance to learn how to onboard logs into Splunk. I tried for hours but I am still unable onboard logs.
Here is what I did...
Spun up a Splunk Cloud instance (pretty straightforward).
Downloaded the Splunk Universal Forwarder (pretty straightforward).
Installed Splunk universal forwarder on my local windows machine 1. Unchecked Splunk on-prem as this is a cloud instance. 2. It asked to create a username and password, I created some crap login details and I don't know why these are for. 3. I chose a local installation not network or domain. 4. It asked for what logs do I need, I chose all except AD logs because mine is local. 5. Now I asked for the location of the deployment server and port. I used my deployment server and left port blank as it takes 8089. 6. Now I wasn't asked for any receiver server details here, which I say in youtube videos for others its asking for receiver server details. 7. Now, click on the install button and installation is successful.
Back to the Splunk cloud instance, I went to Data Inputs
Choose Windows Events and added my workstation hostname in there (it's displaying in here).
I picked to add to index main.
Now it says all done, start searching.
I tried searching and nothing comes up in the server for index=main or host=myhostname
I tried going to the forwarding and receiving section and there there is the only an option for configuring forwarding but there are no receiving options.
Also, in my windows I went to C:\Program Files\SplunkUniversalForwarder\etc\system\local and there is no outputs.conf file here.
There are deploymentclient.conf, authentication.conf, server.conf and input.conf files but there is no outputs.conf.
Can anyone tell me what I have done wrong? Why am I not able to onboard my logs?
I also temporarily disabled my firewall to see if my firewall is blocking but that's not the case and I am able to telnet to the splunk cloud instance.