Splunk Cloud Platform universal forwarder credentials package

[Eshwar]

Hi Community,

We have configured HF and UF then forwarding  data to Cloud instance. The problem is, we have installed SCP credential pack on HF, not in UF so UF is sending data to HF but UF data is not forwarding by HF to Splunk Cloud but HF internal logs are forwarding to Splunk Cloud. So, Is it necessary to install credential pack on UF to see the UF data in Splunk Cloud through HF or any modifications are required at HF to forward UF data?

Please suggest!

Regards,

Eshwar

[richgalloway]

If UFs always forward through HFs then only HFs need the Cloud credentials app.

Are the UFs successfully connecting to the HFs?  Anything in the logs (UF or HF) that might explain what is happening to the UF data?