Splunk Cloud

Splunk Cloud User Manual

Download manual as PDF

Download topic as PDF

Welcome to Splunk Cloud!

This manual contains information to help you get your data into Splunk Cloud, create reports and dashboards, and work with Splunk Support to administer Splunk Cloud and get help.


Splunk Cloud delivers the benefits of award-winning Splunk® Enterprise as a cloud-based service. Using Splunk Cloud, you gain the functionality of the Splunk Enterprise platform for collecting, searching, monitoring, reporting, and analyzing all of your real-time and historical machine data using a cloud service that is centrally and uniformly delivered by Splunk to its large number of cloud customers, from Fortune 100 companies to small and medium-size businesses. Splunk manages and updates the Splunk Cloud service uniformly, so all customers of Splunk Cloud receive the most current features and functionality.

Features of Splunk Cloud

Splunk Cloud is available in multiple regions in AWS. For details please refer to the Splunk Cloud Service Description. The following table lists major features of Splunk Cloud.

Feature Description
Data Collection You can send data to Splunk Cloud as follows:

Using Splunk forwarders: There are two types of forwarder software: universal forwarder and heavy forwarder. In most situations, the universal forwarder is the best forwarder for Splunk Cloud since it includes the essential components that it needs to forward data, uses significantly fewer hardware resources and is inherently scalable. For certain use cases when data needs to be parsed prior to forwarding or data needs to be forwarded based on criteria such as source or type of event, a heavy forwarder is required.

Using HTTP Event Collector (HEC): HEC lets you send data and application events using a token-based authentication mode to Splunk Cloud over the Secure HTTP (HTTPS) protocol. You can generate a token and then configure a logging library or HTTPS client with the token to send data to HEC in a specific format.

Using AWS Kinesis Data Firehose: AWS Kinesis Data Firehose is a fully managed, scalable, and serverless option for streaming data from various AWS services directly into Splunk Cloud.


Ingestion Splunk Cloud indexes incoming data so you can search it. During indexing, data is partitioned into logical indexes, which you can configure to facilitate searching and control users' access to data in specific indexes.
Inputs Data Manager The Inputs Data Manager is a hosted solution for Splunk Cloud for scripted and modular inputs. To use scripted or modular inputs, you must package them in a private app and request that Support uploads it to your IDM. The app must be vetted like any other private app. However, note that an IDM is not a one-to-one replacement for a heavy forwarder. You still need to use a heavy forwarder if you need to perform parsing or activities other than standard scripted and modular data inputs. As a best practice, cloud-based add-ons should be installed on an IDM, and on-premise-based add-ons should be installed on a forwarder or heavy forwarder. Note: If the add-on is tightly integrated with an Enterprise Security search head, you should not use IDM.
Retention When you send data to Splunk Cloud, it is stored in indexes and you can self-manage your Splunk Cloud indexes settings using the Indexes page in Splunk Web. Splunk Cloud retains data based on index settings that enable you to specify when data is to be deleted. To configure different data retention settings for different sources of data, store the data in separate indexes according to the desired retention policy. You can configure different data retention policies for individual indexes according to your auditing and compliance requirements.Each index allows you to specify the maximum age of events in the index (specified in the Retention (days) field) on the Indexes page uses to determine when to delete data. When the index reaches the specified maximum age, the oldest data is deleted.
Search Splunk Cloud allows you to search and navigate all of the machine data that you ingest into the service. Searches can be done using the Splunk Search Processing Language (SPL), or using alternative ways to display and analyze data graphically without composing SPL queries. Searches can be ad-hoc and scheduled, with results in the form of visualizations, reports, and alerts.
Reports Reports are saved searches and pivots. You can run reports on an ad hoc basis, schedule them to run on a regular interval, or set scheduled reports to generate alerts when the results of their runs meet particular conditions. You can add reports to dashboards as dashboard panels. (More information)
Dashboards Dashboards are made up of panels that contain modules such as search boxes, fields, charts, tables, forms, and so on. Dashboard panels are usually hooked up to saved searches or pivots. They can display the results of completed searches as well as data from backgrounded real-time searches. (More information)


Splunk Technical Support

Splunk Standard Support is included in every Splunk Cloud subscription. For details about the levels of technical support provided, read Support Programs. Only authorized support contacts from your company can open cases. Your Splunk support agreement specifies who your authorized contacts are. Your Support contract specifies a number of authorized contacts, and an expiration date. One of your contacts is a Support portal administrator, who can update the list. Only an authorized contact can open a case and track its status. An authorized contact can file a case in one of two ways:

  • Log in to splunk.com and navigate to the Support Portal.
  • In Splunk Cloud, click About and select File a Bug.

Splunk Support portal

Designated Splunk Cloud users can manage operational contacts for their account and file support cases using the Support portal. Operational contacts are the people in your organization who are notified when their Splunk Cloud environment undergoes maintenance or experiences an event that affects performance.

To manage operational contacts:

  1. Go to My Operational Contacts in the Support portal.
  2. Follow the instructions on the page to add, edit, and remove operational contacts for your Splunk Cloud environment.

To file a case on the Support portal:

  1. From the Splunk installation is? dropdown, select the state of your deployment.
  2. In Subject, summarize your issue. Splunk Support sees the first 250 characters in this field.
  3. In What Product are you having trouble with? select Splunk Cloud.
  4. In What OS are you using? select Linux.
  5. Leave What OS Version are you using? blank.
  6. In I need help with... select a category that applies to your issue.
  7. In What is the impact... explain briefly how this issue disrupts your work.
  8. In the Problem Description, be thorough. For issues (as opposed to enhancement requests), include the exact time of the issue and its duration, the type of Splunk instance experiencing the issue (for example, forwarder, search head, or indexers), and any relevant screen shots.
  9. Include Steps to reproduce if you've found a specific scenario that triggers the issue.
  10. Click Submit. The portal directs you to a screen with a case number and sends you an email containing the case number.

Splunk Support replies to the case creator by email. You can update the case by replying to the email (be sure to keep the tracking ID in the email subject line). You can also update the case, check on its status, or close a case using the support portal.

Splunk community

The Splunk user community is a great resource. Check out Splunk Answers, where you can ask and answer questions about the product, or chat live with community members in our IRC channel.

  NEXT
Types of Splunk Cloud deployment

This documentation applies to the following versions of Splunk Cloud: 7.0.0, 7.0.2, 7.0.3, 7.0.5, 7.0.8, 7.0.11, 7.1.3, 7.1.6, 7.2.3, 7.2.4, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 8.0.0


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters