Set a default Splunk Enterprise instance for the Send to a Splunk Index (Default for Environment) function

You can set a default Splunk Enterprise or Splunk Cloud Platform instance for the Send to a Splunk Index (Default for Environment) function to send data to.

Best practices are to use the Send to a Splunk Index with Batching function instead.

Steps

1. From the working directory of a controller node, type the following.

   dsp config set streams pipelines_data_splunkd_hec_host=https://<your-splunk-enterprise-hostname>
   dsp config set streams pipelines_data_splunkd_hec_port=8088   
   dsp config set streams pipelines_data_splunkd_index=main
   dsp config set streams pipelines_data_splunkd_hec_token=<HEC token to write to the index>
   

2. After setting the configurations, deploy your changes.

   dsp deploy streams