Splunk Cloud

Getting Data In

Acrobat logo Download manual as PDF

This documentation does not apply to the most recent version of SplunkCloud. Click here for the latest version.
Acrobat logo Download topic as PDF

Use a gateway forwarder to forward data to Splunk Cloud

You use the gateway forwarder to accept data from other forwarders that are not configured to connect to your Splunk Cloud instance. The gateway forwarder serves as hub for a group of forwarders in different locations.

You can install a deployment server on-premises to synchronize forwarder configurations so that you do not have to configure forwarders manually.


To use the Forward Data page to configure data inputs, you must configure at least one forwarder as a deployment client. If you have not configured a forwarder as a deployment client, the page notifies you that no deployment clients have been found.

The Select Forwarders page

When you select "Forward Data" from the "Add Data" page, the following page appears.

71 SelectSource Forward.png

You can define server classes and add forwarders to those classes. Server classes are logical groupings of hosts based on things such as architecture or host name.

This page only displays forwarders that you configured to forward data and act as deployment clients to this instance. If you have not configured any forwarders, the page warns you of this.

  1. In Select Server Class, click one of the options.
    • New to create a new server class, or if an existing server class does not match the group of forwarders that you want to configure an input for.
    • Existing to use an existing server class.
  2. In the Available host(s) pane, choose the forwarders that you want this instance to receive data from. The forwarders move from the Available host(s) pane to the Selected host(s) pane.

    A server class must contain hosts of a certain platform. You cannot, for example, put Windows and *nix hosts in the same server class.

  3. (Optional) You can add all of the hosts by clicking the add all link, or remove all hosts by selecting the remove all link.
  4. If you chose New in Select Server Class, enter a unique name for the server class that you will remember. Otherwise, select the server class you want from the drop-down list.
  5. Click Next. The Select Source page shows source types that are valid for the forwarders that you selected.
  6. Select the data sources that you want sent to the gateway forwarder.
  7. Click Next to proceed to the Input Settings page.

Next step

Modify input settings

Last modified on 15 February, 2020
Monitor data on a heavy forwarder for Splunk Cloud
Use the Set Sourcetype page on a heavy forwarder for Splunk Cloud

This documentation applies to the following versions of Splunk Cloud: 7.2.4, 7.2.6, 7.2.7, 7.2.8, 7.2.9

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters