Yes, you need to install the Universal Forwarder app downloaded from your Splunk Cloud search head and restart the UF. If you see the UF's internal logs in the Cloud (index=_internal host=<<UF name>>) then it's working and any other data sent to the UF should also make its way to the cloud. Sending syslog directly to a Splunk instance is not recommended, but should work as a trial. (The preferred way is to send syslog to a dedicated syslog server with a UF on it or use Splunk Connect for Syslog (SC4S).) The forwarder needs to have an input defined so it knows to listen on the port to which syslog data is being sent. The inputs.conf stanza will look something like this: [tcp://:514]
index = syslog
sourcetype = cisco:asa
... View more