You can redownload your forwarder credentials by doing step 2 listed here: http://answers.splunk.com/answers/214420/how-do-i-setup-a-splunk-cloud-trial-sandbox-forwar.html#answer-214421 See the writeup on the proper outputs.conf. Note its not the same as the login URL. ... View more

Now with the new version of Splunk, you can get your Forwarder Configuration app right from the GUI. It contains all the settings to setup security and tell the forwarder where to send your machine data. From the Launcher app (default landing page) Look on the left of the screen and click the forwarder app From there you will download your forwarder config app. Follow the instructions and you are good to go. Inside there are a bunch of files, but notice the outputs.conf, and see the server= setting on the line below. So you aren’t using the same FQDN as you use for the UI. [tcpout] defaultGroup = splunkcloud [tcpout:splunkcloud] compressed = false disabled = false server = input-blah.cloud.splunk.com:9997 sslCommonNameToCheck = blah.cloud.splunk.com sslCertPath = $SPLUNK_HOME/etc/apps/splunkclouduf/default/client.pem sslPassword = fdf1c4601674ddd5fca3db0486d927db sslRootCAPath = $SPLUNK_HOME/etc/apps/splunkclouduf/default/cacert.pem sslVerifyServerCert = true useACK = true Give that a whirl and let me know what you think. Regards, Kyle PS One note on WINDOWS forwarders. During installation, the wizard asks you to enter Deployment Server and Receiving Indexer FQDNs or IPs. LEAVE THEM BLANK. The .spl package will configure your receiving indexer(s) for you, and unless you have an on premise DS, then leave it blank. Else, your data will never show up and you will be unhappy. ... View more

to use Splunk Cloud, you must allow your forwarders to talk to your Splunk Cloud instance over TCP port 9997. To determine what indexers you are using, open the Splunk_Forwarder_app that you got when you signed up and look at the outputs.conf file : #SPLUNK CLOUD BASE SETTINGS [tcpout] defaultGroup =splunk_cloud [tcpout:splunk_cloud] useACK = true disabled = false server = idx1.poc5.splunkcloud.com:9997,idx2.poc5.splunkcloud.com:9997,idx3.poc5.splunkcloud.com:9997 ==CHOP== You will see the list of indexers after server= . Resolve those to get the list of IPs. You will also need to allow TCP 443 to access yourdomain.splunkcloud.com. Regarding Deployment Servers, that is presently something that the end-user runs, and is not part of the Splunk Cloud Service. But locally, yes, you need to allow TCP 8089 from UFs to DS. (see this for more info on Regular Splunk Ports: http://answers.splunk.com/answers/58888/what-are-the-ports-that-i-need-to-open) Regarding your VPC. Splunk Cloud environments each have their own VPCs. So you would send data out of your VPC, through AWS and into our VPCs. Splunk Cloud doesn't run in your VPC, and "direct connecting" VPCs is not currently offered. ... View more

Presently with Splunk Cloud you have GUI/UI access only. For search time operations like on-the-fly field extractions, or report transformations -- they can indeed be done using the GUI. For example, my insurgency app, which creates statistics for the video game Insurgency, I want to extract player names from the logs. Extracts are a good way to do field extractions in one fell-swoop (making a change in one file) If your a CLI guy, normally you'd pop into a shell and fire up emacs on a props.conf in the the $SPLUNK_HOME/etc/apps/insurgency_stats/local/props.conf and put this in there: [insurgency] EXTRACT-killed = killed \"(?<killed>.*?)< EXTRACT-killer = :\s+\"(?<killer>.*?)< If you wanted to do the same using the GUI you'd login and goto Settings-> Fields-> Field Extractions. If you wanted to do something slightly more complicated, where say you had an app that you've had installed in Splunk Cloud and you wanted to change its props AND transforms. Take for example the F5 app, which has the both props and transforms. Lets say you wanted to view or modify how its extracting fields. If you were a GUI CLI guy you'd go into $SPLUNK_HOME/etc/app/SplunkforF5Networks/default and look the props.conf and transforms.conf files. To edit props.conf settings from the GUI, you'd go to Settings-> Fields. The entries in the props.conf stanza's line up to different links on this page: So for example, lets look at the six REPORT-s in the props.conf and we'll find them in Settings-> Fields-> Field extractions: Above you see hows the Reports from the props.conf correspond to entries in Field Extractions. Note I filtered the field extractions in the GUI to just show Reports in this apps context. Now for look at the F5:LTM:Syslog:REPORT, note its Extraction/Transform. That will have a corresponding entry in transforms.conf. To view it in the GUI, I go back to Settings-> Fields -> Field transformations and filter for the f5-syslog-eventcode and if I click on the name, I will see the transformation's details: If I look in my $SPLUNK_HOME/etc/app/SplunkforF5Networks/default/transforms.conf, I find this corresponding entry: #transforms.conf [CHOP] [f5-syslog-eventcode] REGEX = \]:\s(........:.):\sPool\s(\S+)\smember\s(\S+)\smonitor\sstatus\s(\S+) \.\s\[\swas\s(\S+)\sfor\s(\S+) FORMAT = event_code::$1 ltm_pool::$2 ltm_member::$3 ltm_monitor_status::$4 ltm _prevstatus::$5 ltm_prevstatus_time::$6 [CHOP] If I were to make a change via the GUI, changes would not be written to $SPLUNK_HOME/etc/app/SplunkforF5Networks/default/transforms.conf. Can you guess why? Because in Splunk, you never change files in the default directory. Best practices states if you are going to change a setting, that you copy your props or transforms into the local directory and then edit. (or better yet, only copy the bits that you plan to change from default). The GUI back end follows this best practice for you, so any changes would be written to $SPLUNK_HOME/etc/app/SplunkforF5Networks/local/transforms.conf. So you can see that while UI is different that CLI, its possible to do search time props and transforms configuration of Splunk Cloud via the UI. Its important to note, that if you are doing index time transforms such as sourcetype overriding or reformatting of data, those changes need to be requested via ticket. The present UI will let you install those changes, but you will notice the output won't be change. Got a question about whether you can or can't make a change? just ask [email protected] or contact support. Thats all for now folks. ... View more

Note as for Jan 31 this is no longer valid. Use this instead: http://answers.splunk.com/answers/214420/how-do-i-setup-a-splunk-cloud-trial-sandbox-forwar.html#answer-214421 You can send data into your Splunk Cloud via forwarder by doing the following: From the Splunk UI, login as Admin Under Settings » Forwarding and receiving, Enable port 9997 from Splunk's UI in your Sandbox instance On your forwarder, you set the outputs to input-.splunk6.splunktrial.com for example I used in my outputs.conf file /opt/splunkforwarder/etc/apps/system/local/outputs.conf [tcpout] defaultGroup = sandbox [tcpout:sandbox] server = input-khourihan-sje-0.splunk6.splunktrial.com:9997 You can find your instance name by going to https://www.splunk.com/getsplunk/cloudtrial and logging into Splunk.com. You can see your Sandbox name there. Then, if you haven't done so already, configure your inputs. Restart your Splunk on your forwarder More references: https://www.splunk.com/view/SP-CAAAM3U I already have a Splunk instance or a Splunk forwarder. How can I send data from my existing Splunk instance to my Splunk Online Sandbox? You can send data from a Splunk forwarder to your Splunk Online Sandbox using the domain name for your sandbox's Splunk Web. To send data directly to your Splunk Online Sandbox, prefix the domain name with "input-". For example, if the url for your Splunk Online Sandbox is https://username.splunktrial.com, forward your data to input-username.splunktrial.com. ... View more