Splunk® IT Service Intelligence

Entity Integrations Manual

Acrobat logo Download manual as PDF


Acrobat logo Download topic as PDF

Send data to Splunk Cloud Platform with ITSI data collection agents

You have to specify a particular hostname and HTTP Event Collect (HEC) port when you configure data collection agents to send data to Splunk Cloud Platform.

When you deploy a universal forwarder to send data to Splunk Cloud Platform, confirm that you already configured credentials for the universal forwarder. For more information, see Configure a universal forwarder to send data to ITSI in Splunk Cloud Platform.

Use Splunk Web to configure data collection

If you're using the Data Integrations page in ITSI, use these field value pairs, when required, so the data collection agents ITSI configures can send data to Splunk Cloud Platform:

Field Value
Monitoring Machine
http-inputs-<cloud_hostname>.splunkcloud.com
HEC port 443

Configure the universal forwarder for Splunk Cloud Platform

You need to install the Forwarder app on Splunk Cloud Platform to install the universal forwarder. A universal forwarder require a hostname and receiver port. For more information, see Use forwarders to get data in to Splunk Cloud in the Splunk Cloud Getting Data in Manual.


Manually configure collectd to collect data

You have to specify server and port for Splunk Cloud Platform in the write_splunk collectd plug-in in collectd.conf. Collectd requires a hostname and HEC port. The plug-in looks like this for Splunk Cloud Platform:

<Plugin write_splunk>
server "http-inputs-<cloud_hostname>.splunkcloud.com"
port "443"
token "<HEC TOKEN>"
ssl true
verifyssl false
Dimension "entity_type:nix_host" 
Dimension "key2:value2"
</Plugin>
Last modified on 03 November, 2021
PREVIOUS
Configure a universal forwarder to send data to ITSI in Splunk Cloud Platform
  NEXT
SKCIntegration

This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.6.0 Cloud only, 4.6.1 Cloud only, 4.6.2 Cloud only, 4.7.0, 4.7.1, 4.7.2, 4.8.0 Cloud only, 4.8.1 Cloud only, 4.9.0, 4.9.1, 4.9.2, 4.9.3, 4.9.4, 4.10.0 Cloud only, 4.10.1 Cloud only, 4.10.2 Cloud only


Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters