Will add-on tested on Splunk Enterprise, work fine on Splunk Cloud as well

[rleena]

We have an add-on which has a modular input. We have tested this addon on a distributed Splunk Enterprise setup.

Is it required to test it again on Splunk Cloud to check whether it will work fine or can we assume it will work as expected on Splunk Cloud as well?

[woodcock]

Splunk Cloud does not allow ANY modular inputs to be installed so you have to setup your own Heavy Forwarder and from there send your data into the Splunk Cloud Indexers. This is very straight-forward and does not require any permission-from or coordination-with Splunk Cloud.

[jconrad_splunk]

Inputs are not permitted on the Search Tier of Splunk Cloud. When installed on the Search Tier any inputs.conf settings within the App or TA will be stripped from it. That said you can either also install the TA onto a On Prem hosted Forwarder / Heavy Forwarder or it can be installed onto an Inputs Data Manager (IDM). Most newer instances should have an IDM built with it and can be accessed via [https://idm-yourstackid.splunkcloud.com]. If you do not have an IDM you can reach out to your local / assigned Splunk Account Rep who can assist with adding one to your Splunk Cloud instance.

Information on IDM's can be found here:
https://docs.splunk.com/Documentation/SplunkCloud/7.2.6/User/WelcometoSplunkCloud#Features_of_Splunk...

[thellmann]

Best practice will actually be for your customers to stand up a Splunk Enterprise Forwarder on-prem, then forward the data from your modular input to their Splunk Cloud deployment. This is because configuration of inputs in Splunk Cloud has additional restrictions that may interfere with setup of your add-on - especially with modular inputs.

If your add-on includes more than just a modular input, your app may be partitioned using the Splunk Packaging Toolkit and the non-Forwarder components installed in Splunk Cloud. If this is the case, your app will need to pass the Splunk Cloud Vetting process, during which we will check for major compatibility issues with Splunk Cloud.

[rleena]

Hi Splunk Team,

Please help me with some insights on this.

Thanks,
Lee