Ingest Processor is currently released as a preview only and is not officially supported. See Splunk General Terms for more information. For any questions on this preview, please reach out to ingestprocessor@splunk.com.

How the destination for Ingest Processor works

In order to send data from an Ingest Processor to a storage location such as an index, or Splunk Observability Cloud, you must define the location as a destination in the Ingest Processor service. Each destination contains the connection information necessary for allowing Ingest Processor to send data to a given location.

The steps for adding a destination to the Ingest Processor service varies depending on whether the destination is part of the Splunk Cloud Platform deployment that's connected to your cloud tenant:

• When you connect your tenant to a Splunk Cloud Platform deployment as part of the first-time setup of the Ingest Processor solution, all the indexers and indexes that the service account can access become available as destinations. For information about working with destinations that are associated with this connection, see Send data from Ingest Processors to the Splunk Cloud Platform deployment connected to your tenant.
• For destinations that are not part of the connected deployment, such as Splunk Observability Cloud or indexes from other Splunk platform deployments, you must use the Destinations page in the Ingest Processor service to add and configure them. See the following pages for more information:
  • Add or manage destinations
  • Send data from Ingest Processors to non-connected Splunk platform deployments using S2S
  • Send data from Ingest Processors to non-connected Splunk platform deployments using HEC

You can confirm the destinations that are available by checking the Destinations page, and view additional details about a given destination by selecting it on the Destinations page.