If you are running uberAgent in combination with Splunk Cloud, there are several things to be aware of. Due to the certification policies for Splunk Cloud apps, the uberAgent indexer app and uberAgent dashboard apps (UXM & ESA) slightly differ from the ones available for download on our website. Hence you need to perform the following tasks by hand after the uberAgent apps have been installed in your Splunk Cloud environment.

uberAgent indexer app

Index creation

Manually create the uberAgent index. This can be achieved by using Splunk Web and the steps provided here. Use the following settings:

• Index Name: uberagent
• Index Data Type: Events
• App: uberAgent_indexer

Feel free to download uberAgent from our website and have a closer look at the settings we ship with the indexes.conf for non-cloud deployments.

Configure Data Input

Splunk Cloud only accepts data via encrypted protocols. This means that you have the following options for sending uberAgent data to Splunk Cloud:

• via uberAgent’s native functionality to send to Splunk’s HTTP Event Collector (HEC). A guide on how to create an HEC token in Splunk Cloud is available here
• via a Universal Forwarder installed on the endpoint and configured to communicate with Splunk Cloud

Alternatively, heavy forwarders can be used. More information on how to configure forwarders to send data to Splunk Cloud can be found here and here.

uberAgent dashboard app

Data model acceleration

Enable acceleration for all uberAgent data models. Please follow the Splunk documentation for guidance.

Data model configuration

To avoid skipped searches, we recommend to allow the Splunk search scheduler to randomly distribute scheduled searches more evenly over their periods. To enable this setting, you need acceleration.allow_skew = 100% to be set within your datamodels.conf file for each uberAgent data model (documentation). As direct modifications to configuration files are not possible when using Splunk Cloud, you need the assistance of Splunk support to change this setting.