Send data to Splunk Cloud Platform with ITSI data collection agents

You have to specify a particular hostname and HTTP Event Collect (HEC) port when you configure data collection agents to send data to Splunk Cloud Platform.

When you deploy a universal forwarder to send data to Splunk Cloud Platform, confirm that you already configured credentials for the universal forwarder. For more information, see Configure a universal forwarder to send data to ITSI in Splunk Cloud Platform.

Use Splunk Web to configure data collection

If you're using the Data Integrations page in ITSI, use these field value pairs, when required, so the data collection agents ITSI configures can send data to Splunk Cloud Platform:

Field	Value
Monitoring Machine	http-inputs-<cloud_hostname>.splunkcloud.com
HEC port	443

Configure the universal forwarder for Splunk Cloud Platform

You need to install the Forwarder app on Splunk Cloud Platform to install the universal forwarder. A universal forwarder require a hostname and receiver port. For more information, see Use forwarders to get data in to Splunk Cloud in the Splunk Cloud Getting Data in Manual.

Manually configure collectd to collect data

You have to specify server and port for Splunk Cloud Platform in the write_splunk collectd plug-in in collectd.conf. Collectd requires a hostname and HEC port. The plug-in looks like this for Splunk Cloud Platform:

<Plugin write_splunk>
server "http-inputs-<cloud_hostname>.splunkcloud.com"
port "443"
token "<HEC TOKEN>"
ssl true
verifyssl false
Dimension "entity_type:nix_host" 
Dimension "key2:value2"
</Plugin>