Hi- We have *nix server (ec2 instance) in AWS. How can we forward one of the application log files from this ec2 instance to our Splunk Cloud instance ? I am bit confused about the approach of using Universal Forwarder. As per https://docs.splunk.com/Documentation/SplunkCloud/8.2.2203/Admin/Configureinputs ; the UF needs to point (via outputs.conf) to the indexer tier. But the indexer tier is all managed by Splunk themselves and we don't have any visibility. Whose hostname or IP am i supposed to put in outputs.conf then ? Pls note my requirement is not about ingesting Cloudwatch or Cloudtrail logs, for that we are all set.
All we have access to is Splunk Cloud Search head ( which is also our IDM Instance) and a couple of Heavy forwarders on premise. As per Forwarding to Splunk cloud from AWS and on prem - Splunk Community we can send UF logs directly to Splunk Cloud which brings me back to my original question about what exactly do i need to put in UF conf file to route it to Splunk Cloud ? Do i need to give the Search head URL ?
Thank you. What about the firewall ports that need to be opened to make this work? Is it just allowing port 443 from AWS network to Splunk Cloud? I couldn't find this info in the documentation.
