topic Re: Network traffic flow integration with Splunk Cloud in Splunk Cloud Platform

Network traffic flow integration with Splunk Cloud

camieya2017 — Mon, 27 Jan 2020 16:00:21 GMT

I currently have Splunk Enterprise on prem and want to move to the Cloud. Do we have to have a separate syslog server to collect all network traffic and have forwarders to send them to Splunk cloud instance? What other ways I can send the network traffic flow to Splunk cloud instance?

Re: Network traffic flow integration with Splunk Cloud

nickhills — Mon, 27 Jan 2020 16:13:16 GMT

Yes - you would want to locate a heavy forwarder/syslog reciver on your local environment to agregate logs, and send them to Splunk Cloud, or install a Universal Forwarder on each host to collect the local syslog.

Commonly, you may do both, and combine with a deployment server to manage all you local UF and HF Splunk components.

Re: Network traffic flow integration with Splunk Cloud

camieya2017 — Mon, 27 Jan 2020 16:22:48 GMT

Thank you for your answer. We are currently moving out of the data center and migrating to azure environment. Do you have a recommendation where we should have a syslog (deployment) server? internal network or dmz, behind firewall on separate domain? The whole point for moving to Splunk Cloud was to avoid to have splunk enterprise on azure. Any recommendations? Thank you so much in advance.

Re: Network traffic flow integration with Splunk Cloud

nickhills — Mon, 27 Jan 2020 16:27:48 GMT

If your network segregation is based on zones (and by which, i mean only your DMZ can access the internet) then I would locate your HF inside the DMZ.
I would probably locate the DS on the internal network.