Login to your Splunk instance, and go to Universal Forwarder link which looks something like this, [Customer Cloud Stack URL]/en-US/app/search/splunkclouduf?earliest=0⪭st= Example: https://prd-p-5dnv2v9jjfrp.cloud.splunk.com/en-US/app/search/splunkclouduf?earliest=0⪭ Change the URL to below, by replacing splunkclouduf from the URL with setupuf: [Customer Cloud Stack URL]/en-US/app/search/setupuf?earliest=0⪭st= and then download the credentials. Hope this helps! ... View more