Splunk Cloud Platform

Splunk Cloud Indexers

briaca
Engager

I am working on configuring a Universal Forwarder to the SPLUNK Cloud. I have everything set up except the cloud is not receiving my data. I am getting a TCP port timeout. My question is where do I find the web address for the indexers to use to send my SPLUNK Cloud Data too. I have three different portals. One is the main portal (I think) and IDM portal and a ES portal. I am trying to send the data to IDM but unfortunately its just not working. Any help would be apprecieated.

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The URL is in the file you downloaded from your Splunk Cloud SH.  Not just the URL, either, the ENTIRE outputs.conf file.  Just install the downloaded app on the forwarder and restart it.  There's no need for configuration - that last step is bogus.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

briaca
Engager

The instructions state you have to configure and outputs.conf file and does not say what url to use. Nothing in the portal says what url to use. If I dont configure a file the splunkd log just says not outputs.conf file configured so it does not send the data anywhere.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The URL is in the file you downloaded from your Splunk Cloud SH.  Not just the URL, either, the ENTIRE outputs.conf file.  Just install the downloaded app on the forwarder and restart it.  There's no need for configuration - that last step is bogus.

---
If this reply helps you, an upvote would be appreciated.

richgalloway
SplunkTrust
SplunkTrust

None of those 3 "portals" are used by the UF.  Go to the "Universal Forwarder" app on your Splunk Cloud search head and follow the instructions there.  They will have you download an app to install on the UF which will configure the forwarder to talk to your cloud indexers.

---
If this reply helps you, an upvote would be appreciated.
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...