yeah that is to unsecured
I found I could do like this and it is working
Once the Splunk App for Stream is installed on a Splunk Search Head, there will be a Splunk_TA_stream directory that’ll be created in $SPLUNK_HOME/etc/apps. Splunk_TA_stream will then need to be copied over to your windows machine under $SPLUNK_HOME\etc\apps (typically C:\Program Files\SplunkUniversalForwarder\etc\apps). From there, you’ll need to create a local directory and inputs.conf file within. Contents of the inputs.conf file should be as follows, just be sure to replace “localhost” with the hostname of the SH where the Stream app exists, and be sure to modify http/https and the port, where appropriate:
splunk_stream_app_location = https://localhost:8000/en-us/custom/splunk_app_stream/
disabled = 0
Then, make sure the windows machines has the outputs.conf to send data to Splunk Cloud, and restart the forwarder.
... View more