topic Re: Streaming data from local HEC to splunk cloud in All Apps and Add-ons

Streaming data from local HEC to Splunk Cloud

rasikmhetre — Tue, 09 Aug 2022 15:26:00 GMT

I have successfully implemented this thing in my personal account and it works fine with the local HEC -> splunk cloud, but in my organization's environment local HEC gives a successful response code but the indexer fails to index the data because HEC couldn't send data to Splunk cloud indexers.

I noticed that I am not able to connect to the indexer's domain name or IP address on port 9997 do I need to explicitly allow any rule from Splunk cloud for indexers?

Re: Streaming data from local HEC to splunk cloud

inventsekar — Tue, 09 Aug 2022 12:50:28 GMT

Hi @rasikmhetre ... You should be able to contact the Splunk Cloud Support and they should help you on almost all support related issues.

> I noticed that I am not able to connect to the indexer's domain name or IP address on port 9997 do I need to explicitly allow any rule from Splunk cloud for indexers?

did you use the private ip or public ip?.. You could check with the Splunk Cloud Support for this task as well.

Re: Streaming data from local HEC to splunk cloud

rasikmhetre — Tue, 09 Aug 2022 12:59:54 GMT

Thanks for your reply @inventsekar

did you use the private IP or public IP? - it's public.

I replicated the same thing in my personal account and it worked perfectly fine. I have already raised a support case but thought of posting on the community for a faster answer.