cloud-splunk.conf

# Splunk Cloud Configuration
# Forward logs to Splunk Cloud via TLS syslog
# Documentation: https://docs.splunk.com/Documentation/Splunk/latest/Data/Monitornetworkports

[Network]
# Splunk Cloud TLS endpoint (replace with your endpoint)
# Format: input-<customer>.cloud.splunk.com:6514
# Find your endpoint in: Settings > Data Inputs > TCP > Configure TLS
Address=input-prd-p-XXXXXX.cloud.splunk.com:6514

# Use TLS for secure transmission
Protocol=tls

# RFC 5424 format (recommended by Splunk)
LogFormat=rfc5424

# Strict certificate validation
TLSCertificateAuthMode=deny

# Splunk Cloud uses DigiCert certificates
# System CA bundle should include DigiCert roots
TLSServerCertificate=/etc/ssl/certs/ca-certificates.crt

# Connection settings
KeepAlive=yes
NoDelay=yes
ConnectionRetrySec=30

# Add Splunk-specific structured data
# Replace 'myapp' with your application name
# Replace 'prod' with your environment
StructuredData=[splunk@32473 index="main" sourcetype="syslog" source="systemd-netlogd" environment="prod"]

# Optional: Filter to reduce ingestion costs
# Exclude debug messages
ExcludeSyslogLevel=debug

# Splunk setup checklist:
# [ ] Get your TLS endpoint from Splunk Cloud portal
# [ ] Replace input-prd-p-XXXXXX with your actual endpoint
# [ ] Create or verify index exists in Splunk (default: 'main')
# [ ] Set up sourcetype in Splunk if using custom value
# [ ] Configure log retention policy in Splunk
# [ ] Set up Splunk alerts and dashboards
# [ ] Test with: logger -p user.info "Splunk test message"
# [ ] Verify in Splunk: index="main" sourcetype="syslog" source="systemd-netlogd"