You can use the universal forwarder. The docs are somewhat confusing, but the line that says "Both full instances of Splunk Enterprise and universal forwarders support local collection of printer subsystem information. If you have Splunk Cloud and want to monitor printer subsystem information, use the universal forwarder to consume the information and forward it to your Splunk Cloud deployment." Splunk Cloud is Linux based, so there's no reason you can't install the UF and send data to your Linux based indexers. I sent a comment to the doc team to clarify the documentation. ... View more