Currently this is not possible.  You can see it requested on ideas.splunk.com and upvote the feature if you wish. Ability to stack DDSS AFTER DDAA | Ideas (splunk.com)   ... View more

The free trial doesn't have the API port open, if I recall.  Can you ping the port ?  8089? ... View more

| dbinspect index=* | stats count by splunk_server index bucketId | fields - count | eventstats count(bucketId) As cluster_buckets | eventstats dc(bucketId) As num_buckets by index | stats Max(num_buckets) As num_buckets Max(cluster_buckets) As cluster_buckets by index | table index num_buckets cluster_buckets Run over all time. ... View more

best bet is to talk to your compliance people and get their recommendations.  Every auditor is different. OR Splunk Cloud SaaS has PCI compliant environments you can purchase, then you are done.   ... View more

Request a feature on ideas.splunk.com, asking for support of more than 1 SAML IDP.   ... View more

You need to use transforms.conf to mask the data, so that's not something you can do in the UI presently.  However, you can create a configuration app and, now with Splunk 7.2+ you can upload both the props and transforms and install them to both Seach Head and indexers, via a new Splunk API call that applies cluster bundles to the indexers via the clustermaster.  All that is done behind the scenes.   Check this out: https://docs.splunk.com/Documentation/SplunkCloud/8.0.2006/User/PrivateApps     ... View more

Heavy Forwarders can accept HEC inputs, but not send out to  HEC outputs.   They can either send to Syslog or to a Splunk Indexer endpoint using Splunk2Splunk protocol. Universal forwarders do not TODAY have HEC input capabilities.       ... View more

You will need to file a ticket and have them open port to LDAP and you better use LDAPs (usually port 636 i believe) but best to configure SAML using the authentication settings. ... View more

Are you using a free trial? If you have have a Splunk Cloud paid environment, you get a support contract and you (or an authorized user) can file a ticket asking for an app to get installed. Also you can upload you own apps now. ... View more

I downvoted this post because silly answer ... View more

Try this | metadata index=main type=hosts | stats min(firstTime) max(lastTime) by host ... View more

The api doesn't authenticate via 443 which is where the SAML would live. The API uses 8089 would just need local user auth. ... View more

Duo IDP is not supported in in Cloud b/c it cuts off local users needed for administration in Splunk Cloud. If DUO re-writes its IDP in the future it maybe possible. ... View more

Pros: Nice thing is that you don't have to update your forwarder app every time you add / remove and indexer - Peers add themselves into the pool Weighted Load balancing to spray the data on the indexers with most disk, so no fiddling with putting indexers in detention (most of the time Cons: You have to setup and manage a pass4symmkey You have to allow the forwarders to talk to the clustermaster, which could introduce load on a busy CM See this doc link for all the details: http://docs.splunk.com/Documentation/Splunk/7.0.0/Indexer/useforwarders#Advantages_of_the_indexer_discovery_method ... View more

The 15 day free trial does expose the API. Its sitting on a different URL. Put an input- infront of your instance name.. i.e. root@Blue10:~# telnet input-prd-p-mt4lbmbctrhk.cloud.splunk.com 8089 Trying 54.90.67.167... Connected to input-prd-p-mt4lbmbctrhk.cloud.splunk.com. Escape character is '^]'. ... View more

Communication is secured using the pass4symmkey. (Shared Secret). You should file a ticket asking asking for Hybrid search to be setup, then support will send your the URI to your c0m1 (clustermaster) and a secret key. Note: Hybrid search must be requested as its not setup by default. Also, you should provide a whitelist of IPs for your on-prem searchheads. ... View more

Its there, put a input- in front of your hostname. and its listening on 8089. example: $ curl -k -u kyle:password https://input-prd-p-lbtde337wtp8.cloud.splunk.com:8089/servicesNS/admin/search/data/indexes -d name=test123 ... View more

If you are asking will the app work if you use different index names? in the Unix app, in particular, it uses a macro os_index see below: You'd need to add the additional index names into that Macro. I've not used the *nix app in a while, but looks like you can do some setup using the app's GUI: So hopefully you will be able to effect the change that way, but editing the macro is a sure fire way. ... View more