Product documentation
uberAgent
Current Release (7.3.0) 7.2.1 7.2.0 7.1.2 7.1.1 7.1.0 7.0.2 7.0.1 7.0.0
View PDF

uberAgent With Splunk Cloud: Differences to On-Premises Splunk Enterprise

July 30, 2024
Contributed by: 
C

If you are running uberAgent in combination with Splunk Cloud, there are several things to be aware of. Due to the certification policies for Splunk Cloud apps, the uberAgent indexer app and uberAgent dashboard apps (UXM & ESA) slightly differ from the ones available for download on our website. Hence you need to perform the following tasks by hand after the uberAgent apps have been installed in your Splunk Cloud environment.

uberAgent Indexer App

Index Creation

Manually create the uberAgent index. This can be achieved by using Splunk Web and the steps provided here. Use the following settings.

uberAgent Events

  • Index Name: uberagent
  • Index Data Type: Events
  • App: uberAgent_indexer

uberAgent Scores

  • Index Name: score_uberagent_uxm
  • Index Data Type: Events

  • App: uberAgent_indexer

  • Index Name: score_uberagent_esa
  • Index Data Type: Events
  • App: uberAgent_indexer

Further index settings depend on your individual requirements. Feel free to download uberAgent from our website and have a closer look at the settings we ship with the indexes.conf for non-cloud deployments.

Configure Data Input

Splunk Cloud only accepts data via encrypted protocols. This means that you have the following options for sending uberAgent data to Splunk Cloud:

  • via uberAgent’s native functionality to send to Splunk’s HTTP Event Collector (HEC). A guide on how to create an HEC token in Splunk Cloud is available here
  • via a Universal Forwarder installed on the endpoint and configured to communicate with Splunk Cloud

Read here if you run into problems with self-signed certificates and how that affects your uberAgent deployment.

Alternatively, heavy forwarders can be used. More information on how to configure forwarders to send data to Splunk Cloud can be found here and here.

uberAgent Dashboard App

Data Model Acceleration

Enable acceleration for all uberAgent data models. Please follow the Splunk documentation for guidance.

Data Model Configuration

To avoid skipped searches, we recommend allowing the Splunk search scheduler to randomly distribute scheduled searches more evenly over their periods. To enable this setting, you need acceleration.allow_skew = 100% to be set within every uberAgent’s app datamodels.conf file for each uberAgent data model (documentation).

The customization may be applied in one of these two places:

  • Directly modify the datamodels.conf file shipped with the uberAgent apps in $SPLUNK_HOME/etc/apps/[uberAgent|uberAgent_ESA]/default/
  • Create a new datamodels.conf file containing the acceleration.allow_skew setting in $SPLUNK_HOME/etc/apps/[uberAgent|uberAgent_ESA]/local/

For reference, please download uberAgent from our website to inspect the settings we ship with the datamodels.conf for non-cloud deployments. As direct modifications to configuration files are not possible when using Splunk Cloud, you need the assistance of Splunk support to change this setting.

uberAgent HTTP Event Collector (HEC) Receiver Configuration

Carefully read Splunk’s documentation on how to send data to a HEC on Splunk Cloud Platform.

Important: Do not add the <endpoint> option, e.g. /services/collector/event, to your receiver configuration, as uberAgent does this automatically.

uberAgent With Splunk Cloud: Differences to On-Premises Splunk Enterprise
July 30, 2024
Contributed by: 
C
July 30, 2024
Contributed by: 
C

In this article

Site feedback | Your privacy choices footer linkYour Privacy Choices | Privacy and legal terms | Cookie preferences | Consent settings | docs.cloud.com
© 1999- Cloud Software Group, Inc. All rights reserved.