I'm unaware of any limits here...I haven't seen a documented limit for Splunk cloud instances for REST APi calls. There may be an AWS system that is helping to prevent a flood of traffic...(I'm not familiar with the actual Splunk cloud build) ... View more

127.0.0.1 is localhost which cannot use from outside of that host. Basically you must know the external IP address or FQDN (full qualified domain name) for those hosts where you have installed those components.  ... View more

Hi @asmyth1995 , you can configure the UF installed on the Domain Controllers to send logs both to the HF anf through them to Splunk Cloud and at the same time you can send logs to a third party using syslogs. You have to follow the instructions at the above link using as indexer the Ip address of the HF and as syslog server the ip of your third party. Ciao. Giuseppe ... View more

Yes ... View more

If you only have a single Universal Forwarder (UF) then you don't need deploymentclient.conf.  Worry about that when you have multiple UFs to manage. The outputs.conf file is provided by Splunk.  Go to the "Universal Forwarder" app on your Splunk Cloud trial instance.  Download the configuration file provided by the app and install it on the UF.  Instructions are in the app. The UF does come with inputs.conf, but it's not where the docs say it is.  You can find the file in $SPLUNK_HOME/etc/system/default.  DO NOT MODIFY ANY FILES IN THIS DIRECTORY.  Instead, copy the stanza name and the settings you wish to change to $SPLUNK_HOME/etc/system/local and make your changes there. ... View more