How (the hell) do you set up Splunk Cloud on Linux?

Wed, 29 Oct 2014 14:11:40 +0000

This took me way longer than I would’ve thought, mostly due to horrible documentation. Here’s my TL;DR version:

Sign up for Splunk Cloud
Download and install the forwarder binary from here.- Log in here and note the URL of your Splunk instance:

In the above picture, assume the URL is https://prd-p-jxxxxxxxx.splunk6.splunktrial.com.

Make sure your instances can connect to port tcp/9997 on your input host. Your input host is the hostname from above with “input-” prepended to it. So in our example, the input host is input-prd-p-jxxxxxxxx.splunk6.splunktrial.com. To ensure you can connect, try telnet input-prd-p-jxxxxxxxx.splunk6.splunktrial.com 9997. If it can’t connect you may need to adjust your firewall rules / Security groups to allow outbound tcp/9997

Below are the actual commands I used to get data into our Splunk Cloud trial instance:

Logging RT username in Apache access_log

Mon, 08 Aug 2011 17:34:18 +0000

RT has its own internal accounting & tracking system for logging activity, but I was interested in even more granular stuff, like seeing who looked at which tickets. I figured it wouldn’t be that hard to log this in Apache. Well, I was kind of right, in that it wasn’t “hard,” but it took me a long time to find the right place to do it. I did finally get it though.

Logging on Evan Hoffman

How (the hell) do you set up Splunk Cloud on Linux?

Logging RT username in Apache access_log