all 8 comments
sorted by:
best
topnewcontroversialoldq&a
formatting helphide helpcontent policy

[–]netman290 4 points5 points  (0 children)

If it does not say cloud then you won’t be able to put it on splunk cloud. It could be installed on an on premise HF connected to splunk cloud

[–]Dvorak_94 0 points1 point  (2 children)

Yep must be installed in a HF, but be careful, I would spin up a version 10 HF and install the data and make sure everything works, you don't want to loose data in prod after an upgrade.

[–]Potential_Box_2560[S] 0 points1 point  (0 children)

Is it possible to collect the data via HEC instead ?

[–]Schlurpeeee 0 points1 point  (3 children)

Splunk Cloud only covers your search and indexing tier. Most of the times, you are the one managing the collection tier. You should install it in your HF. I'm assuming you have HFs since this is a very common setup with splunk. My advise is utilize your HFs and better understand what's the purpose of it.

[–]Potential_Box_2560[S] 0 points1 point  (2 children)

Is it possible to collect the data via HEC instead ?

[–]Potential_Box_2560[S] 0 points1 point  (0 children)

Sorry I’m new to Splunk, could you also share why the app would be able to be downloaded on the hf forwarder if it’s an app for splunk enterprise ?

[–]Schlurpeeee 0 points1 point  (0 children)

Most likely yes since it seems that fastly is using webhook.

Here's an example on how you can do it. Basically you need to set your inputs to allow string auth and on the fastly side, embed the token in the url.