Possible to forward results from Splunk for Asset Discovery App to Splunk Cloud?

[cjbischoffmck]

Would it be possible to run this application in the following fashion -

On local/on-premise machines perform the scanning - then using the local forwarder to send results to Splunk in the Cloud (where the app is installed?

[mw · Accepted solution]

Yes it is. It's really just a simple matter of configuring the universal forwarder (your scanner) to forward to your cloud-based server (possibly through an intermediate forwarder). Really, there are a number of options for deployment topologies, but certainly a hybrid on-prem/cloud topology in a general sense is one of them. Here's a link to the forwarder documentation: http://docs.splunk.com/Documentation/Splunk/6.1.2/Forwarding/Aboutforwardingandreceivingdata .

I would also encourage you to get in touch with sales@splunk.com to engage your local sales team who can assist you in determining the correct architecture for your requirements.

These links may also be of interest:
http://www.splunk.com/web_assets/pdfs/secure/Splunk_for_Amazon_Web_Services.pdf
http://www.splunk.com/view/cloud/SP-CAAAG58

[cjbischoffmck]

Installed on the local machine (syslog server with Splunk Forwarder installed) Performed post configuration - restarted Splunk. How do I check if the inputs.conf is correct?

$SPLUNK_HOME/bin/splunk list monitor doesnt show the script to be executed - just show the files being monitored.

[mw]

That's correct. On-prem, each "scanner" would have the Splunk universal forwarder installed with forwarding configured, as well as the Asset Discovery app with its scripted inputs enabled. The cloud would consist of your Splunk server which also has the same app installed and "receiving" enabled.

[cjbischoffmck]

I am guessing I will need to install the app both cloud and on-premise. Downloading the application to see the internals - thanks