All Apps and Add-ons

Possible to forward results from Splunk for Asset Discovery App to Splunk Cloud?

cjbischoffmck
New Member

Would it be possible to run this application in the following fashion -

On local/on-premise machines perform the scanning - then using the local forwarder to send results to Splunk in the Cloud (where the app is installed?

0 Karma
1 Solution

mw
Splunk Employee
Splunk Employee

Yes it is. It's really just a simple matter of configuring the universal forwarder (your scanner) to forward to your cloud-based server (possibly through an intermediate forwarder). Really, there are a number of options for deployment topologies, but certainly a hybrid on-prem/cloud topology in a general sense is one of them. Here's a link to the forwarder documentation: http://docs.splunk.com/Documentation/Splunk/6.1.2/Forwarding/Aboutforwardingandreceivingdata .

I would also encourage you to get in touch with sales@splunk.com to engage your local sales team who can assist you in determining the correct architecture for your requirements.

These links may also be of interest:
http://www.splunk.com/web_assets/pdfs/secure/Splunk_for_Amazon_Web_Services.pdf
http://www.splunk.com/view/cloud/SP-CAAAG58

View solution in original post

0 Karma

mw
Splunk Employee
Splunk Employee

Yes it is. It's really just a simple matter of configuring the universal forwarder (your scanner) to forward to your cloud-based server (possibly through an intermediate forwarder). Really, there are a number of options for deployment topologies, but certainly a hybrid on-prem/cloud topology in a general sense is one of them. Here's a link to the forwarder documentation: http://docs.splunk.com/Documentation/Splunk/6.1.2/Forwarding/Aboutforwardingandreceivingdata .

I would also encourage you to get in touch with sales@splunk.com to engage your local sales team who can assist you in determining the correct architecture for your requirements.

These links may also be of interest:
http://www.splunk.com/web_assets/pdfs/secure/Splunk_for_Amazon_Web_Services.pdf
http://www.splunk.com/view/cloud/SP-CAAAG58

0 Karma

cjbischoffmck
New Member

Installed on the local machine (syslog server with Splunk Forwarder installed) Performed post configuration - restarted Splunk. How do I check if the inputs.conf is correct?

$SPLUNK_HOME/bin/splunk list monitor doesnt show the script to be executed - just show the files being monitored.

0 Karma

mw
Splunk Employee
Splunk Employee

That's correct. On-prem, each "scanner" would have the Splunk universal forwarder installed with forwarding configured, as well as the Asset Discovery app with its scripted inputs enabled. The cloud would consist of your Splunk server which also has the same app installed and "receiving" enabled.

0 Karma

cjbischoffmck
New Member

I am guessing I will need to install the app both cloud and on-premise. Downloading the application to see the internals - thanks

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...