Configure forwarding and receiving for Splunk Cloud

Your Splunk Cloud instance acts as your receiver. Use these tasks to configure your forwarders to send data to Splunk Cloud.

To get data from your data source into your Splunk Enterprise instance, configure a receiver and a forwarder. The receiver is your Splunk Cloud instance. Install a forwarder on your data host to send data to the receiver.

Download and install the forwarder credentials to connect your forwarder to your Splunk Cloud instance

To enable your forwarders to send data to Splunk Cloud, download the universal forwarder credentials file. This file contains a custom certificate for your Splunk Cloud deployment.

Download the forwarder credentials

1. In your Splunk Cloud deployment, navigate to the Splunk Cloud Home page.
2. Click Universal Forwarder.
3. On the Splunk Cloud Home page, click Download Universal Forwarder Credentials to download the splunkclouduf.spl file.
4. When prompted, click Save File and click OK. By default, the splunkclouduf.spl file downloads to the Downloads directory. If you download to a different location, make note of that location.

Install the file onto your forwarders using one of the two installation options described in this topic. Apply these credentials to forwarders of any type that you need to connect to your Splunk Cloud instance.

Install the forwarder credentials on individual forwarders

1. Move the splunkclouduf.spl file to the $SPLUNK_HOME/etc/apps/ directory of your forwarder.
2. Open a command prompt window and, run the following command:

   splunk install app <full path to splunkclouduf.spl> -auth <username>:<password>

   where <full path to splunkclouduf.spl> is the path to the directory where the splunkclouduf.spl file is located and <username>:<password> are the username and password of an existing admin account on the forwarder.
3. Restart your forwarder: /splunk restart.

Install the forwarder credentials on a deployment server

1. Move the splunkclouduf.spl file to the $SPLUNK_HOME/etc/deployment-apps/ directory of your deployment server.
2. Open a command prompt window, and run the command tar xvf splunkclouduf.spl.
3. Navigate to the /bin subdirectory of your deployment server.
4. In the command prompt window, run the command:

   splunk install app <full path to splunkclouduf.spl> -auth <username>:<password>

   where <full path to splunkclouduf.spl> is the path to the directory where the splunkclouduf.spl file is located and <username>:<password> are the username and password of an existing admin account on the universal forwarder.
5. Restart your deployment server: /splunk restart.