https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-Connect-4-Syslog-IDM/m-p/545908#M65249 <P>If you have Splunk Cloud then you have indexers.&nbsp; Configuring HEC input on Splunk Cloud puts the input on the indexers.</P> Mon, 29 Mar 2021 18:09:34 GMT richgalloway 2021-03-29T18:09:34Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-Connect-4-Syslog-IDM/m-p/545872#M65244 <P>Does anyone know if HEC endpoint can be configured directly onto the IDM so SC4S traffic can be sent to it? It is tailor made for Splunk Cloud but I have not read anything that says that in their documentation.</P> Mon, 29 Mar 2021 15:22:35 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-Connect-4-Syslog-IDM/m-p/545872#M65244 sunaryot 2021-03-29T15:22:35Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-Connect-4-Syslog-IDM/m-p/545882#M65246 <P>The SC4S team recommends traffic be sent directly to HEC inputs on the indexers.</P> Mon, 29 Mar 2021 16:03:12 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-Connect-4-Syslog-IDM/m-p/545882#M65246 richgalloway 2021-03-29T16:03:12Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-Connect-4-Syslog-IDM/m-p/545889#M65247 <P>In our splunk cloud environment, we currently do not have any indexers deployed since we have an IDM and multiple HFs. It is strongly recommended that we send the traffic to the HEC endpoints configured directly on the indexers but would it work by configuring the HEC endpoint on Splunk Cloud?</P> Mon, 29 Mar 2021 16:33:03 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-Connect-4-Syslog-IDM/m-p/545889#M65247 sunaryot 2021-03-29T16:33:03Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-Connect-4-Syslog-IDM/m-p/545897#M65248 <P>If you have a recently provisioned SplunkCloud stack, you have a HEC address provisioned and enabled for you already.</P><P>Your target HEC URL should be&nbsp;</P><LI-CODE lang="markup">http-inputs-{yourstackname}.splunkcloud.com</LI-CODE><P>You will find more documentation <A href="https://docs.splunk.com/Documentation/Splunk/latest/Data/UsetheHTTPEventCollector#HEC_and_managed_Splunk_Cloud" target="_self">here</A>.&nbsp;</P><P>You should be able to send HEC traffic directly to this VIP address. If this doesn't work, please open a case with Splunk support.</P> Mon, 29 Mar 2021 17:16:59 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-Connect-4-Syslog-IDM/m-p/545897#M65248 s2_splunk 2021-03-29T17:16:59Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-Connect-4-Syslog-IDM/m-p/545908#M65249 <P>If you have Splunk Cloud then you have indexers.&nbsp; Configuring HEC input on Splunk Cloud puts the input on the indexers.</P> Mon, 29 Mar 2021 18:09:34 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-Connect-4-Syslog-IDM/m-p/545908#M65249 richgalloway 2021-03-29T18:09:34Z