Can you forward data to the sandbox server with a universal forwarder?

[svertner]

I have setup a sandbox and wish to test the universal forwarder to send data to the sandbox. I do not see a way to add this data into the sandbox. I have installed the universal log forwarder on another external system and wanted to have it send data to the new sandbox. Is this possible?

[ryoung_splunk · Accepted solution]

Since early December 2014 the steps to use a forwarder in the sandbox have changed. To forward data to a sandbox you can use Universal Forwarder App available in Splunk Online Sandbox. The Universal Forwarder App includes the information and credentials necessary to download, install, and authorize you to forward data to Splunk Online Sandbox. After you sign in to Splunk Online Sandbox, choose Universal Forwarder from the Apps menu, and follow the Universal Forwarder app instructions.

[khourihan_splun]

http://answers.splunk.com/answers/147295/how-do-i-send-my-own-data-into-a-splunk-cloud-sandbox-trial

[kristian_kolb]

To understand how to do that, you may want to look closer on the "Getting Data In" section of the manual. The following to sub-sections relate to forwarders and their configuration.

http://docs.splunk.com/Documentation/Splunk/6.1.3/Data/Usingforwardingagents
http://docs.splunk.com/Documentation/Splunk/6.1.3/Data/Useforwardingagentstogetdata

/K

[khourihan_splun]

@svertner When you login to https://www.splunk.com/getsplunk/cloudtrial

click "See the status" and there you will get your URL that you use for the forwarder's outputs.conf. See my link above for more details.

[svertner]

I do not see a way to get the external IP address of the sandbox for this to work? I would assume based on what I am seeing in the sandbox that these are internal VM's and may not be accessible externally. Is that true?