Splunk Cloud

Splunk Heavy Forwarded to Splunk Cloud?

JohnACERTUS
New Member

Am I going crazy or is there legit not documentation on setting up a HF to point and send data to our cloud instance?  

 

All the documentation I am finding is centered around a 100% on-prem setup.  

 

Anyone have any luck with this?

Labels (1)
0 Karma

JohnACERTUS
New Member

I've done this 

"If you want to set up a heavy forwarder to send data in Splunk Cloud, request a deployment server license from Splunk support to allow them to carry out functions above and beyond what is covered by the forwarder license. See Data collection in the Splunk Cloud Service Description."

On the data collection link, can you point to me where it specifies? 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Follow the instructions in the second link provided.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

JohnACERTUS
New Member

Maybe I'm still missing something but i've read over that documentation and noticed that it still doesn't specify how to forward logs from HF to splunk cloud.  One notable thing is it doesn't say what the URL:PORT to use...  

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It's documented.  See https://docs.splunk.com/Documentation/SplunkCloud/8.1.2101/Data/UsingforwardingagentsCloud or https://docs.splunk.com/Documentation/Forwarder/latest/Forwarder/HowtoforwarddatatoSplunkCloud

You also can go to the "Universal Forwarder" app in your Splunk Cloud instance for instructions.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

JohnACERTUS
New Member
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Splunk is a very Linux-centric company so Windows-oriented instructions are not as common as they could be. Most of the time, all a Windows admin needs to do is change file path delimiters, but every now and then a Linux command has to be replaced with a Windows equivalent.  

In this case, I use 7-zip in place of tar.  Also, Ubuntu on Windows has tar available.

---
If this reply helps you, an upvote would be appreciated.
0 Karma