Hi, I've looked around in the documentation for how to set an archiving policy in Splunk Cloud, but I haven't found an answer yet. I know that the document "Safeguarding Customer Data in Splunk Cloud" talk about archiving, but in this paper they call it archiving when data is rolled from hot to warm. I want to to know if there's a way to roll to frozen in Splunk Cloud, and if so, what's the price of storing data this way compared to storing data in warm buckets? ... View more

Hi, I'm wondering how load balancing in Splunk Cloud work. When i install the splunkcloud.uf app on a local forwarder, the outputs.conf that is created in the app looks like so: [tcpout:splunkcloud] compressed = false disabled = false server = input-prd-p-<id>.cloud.splunk.com:9997 sslCommonNameToCheck = input-prd-p-<id>.cloud.splunk.com sslCertPath = $SPLUNK_HOME/etc/apps/splunkclouduf/default/client.pem sslPassword = <password> sslRootCAPath = $SPLUNK_HOME/etc/apps/splunkclouduf/default/cacert.pem sslVerifyServerCert = true useACK = true Notice that there is only one server listed. When I search for "splunk_server" in my Splunk Cloud it clearly says I have five indexers. Why aren't all those listed behind "server" as normal when using load balancing? I know there is something called the indexer discovery feature, but then I guess I would see a stanza for that in my outputs.conf. Could someone explain this to me? ... View more

Hi, On Splunk Cloud, the admin role has by default access to all non-internal indexes. At a customer's site, we want to retain the the access rights of admins by keeping "available indexes" (with the exception of internal indexes) in their own "access roles." Thus, our admin role would only grant the user the capabilities of the admin, but not any non-internal indexes. Those indexes would have to be granted by their own 1:1 access roles. Our problem is that when we grant a user the custom admin role we've created, that user can't see the graphs in the "distributed management console." It seems like the users aren't allowed to see the _internal index, even though it clearly says in the custom admin role we've created that all internal indexes should be searchable. We've even added the index _internal specifically, in addition to "all internal indexes," just to be sure. What's interesting is that if we let our custom admin role inherit from the default admin role, then it works. Any idea of what could be the problem here? Could there be some sort of "hidden" access right or capability on the default admin role in Splunk Cloud? ... View more

Hi, As far as I know it's possible to send email from Splunk Cloud using mail host 127.0.0.1:25, which also is sat as mail host by default. I'm having some troubles sending email from my Splunk Cloud Trial instance. I've tried sending emails to a couple of different email accounts to ensure that there are no filters blocking out the emails, and I've also tried using a different mail host belonging to the customer I'm currently working for, but with no luck. Could there be any limitations on the Splunk Cloud Trial that prevents me from sending emails? If not, does anyone have any idea on what may be the problem? Thanks! ... View more