topic Heavy Forwarder to Splunk Cloud issue in Splunk Cloud Platform

Heavy Forwarder to Splunk Cloud issue

Alan_Chan — Wed, 09 Apr 2025 10:30:27 GMT

I am using Heavy Forwarder to forward log to Splunk cloud, when I installed the splunkclouduf.spl to splunk

autoloadbalancedconnectionstrategy cooked connection to xxx.xxx.xxx.xxx:9997

May I know the IP address of Splunk Cloud Indexer and Search head are fixed or changeable?

And for the firewall rule, should I use IP address or DNS to allow the traffic?

Re: Heavy Forwarder to Splunk Cloud issue

kiran_panchavat — Wed, 09 Apr 2025 11:19:41 GMT

@Alan_Chan

The Cloud forwarder package/app contains DNS entries for the indexers in outputs.conf. This enables indexers to be replaced/scaled without the customer having to update outputs.conf

Refer this links

https://community.splunk.com/t5/Getting-Data-In/How-do-I-get-the-IP-addresses-for-my-Indexers-in-Splunk-Cloud/m-p/388836

https://community.splunk.com/t5/Splunk-Search/I-want-IPs-for-Splunk-Cloud-indexers-for-firewall-rules-How-can/m-p/387482

Re: Heavy Forwarder to Splunk Cloud issue

livehybrid — Wed, 09 Apr 2025 12:51:06 GMT

Splunk Cloud indexer IP addresses can change over time; they are not fixed as they may scale in/out or be replaced during upgrades.

Always use the provided DNS hostname (e.g., inputsXX.stackName.splunkcloud.com) for forwarding and firewall rules.

For firewall configuration, allow outbound traffic on port 9997 to the Splunk Cloud DNS hostname, not specific IPs.

Splunk Cloud Search Heads IPs are less likely to change as they are updated less frequently but there is no guarantees that they will persist.

Some useful docs: https://docs.splunk.com/Documentation/SplunkCloud/latest/Service/SplunkCloudservice#Network_connectivity_and_data_transfer

🌟 Did this answer help you? If so, please consider:

Adding kudos to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Heavy Forwarder to Splunk Cloud issue

isoutamo — Wed, 09 Apr 2025 19:44:26 GMT

As already said you should use fqdn based fw opening to those dns names.
In real life those ips are probably quite stable as long as you are using Victoria stack and don’t change its region. Based on this you could try to use ip based fw openings too, but time by time that could break your traffic if/when those ips have changed.

Re: Heavy Forwarder to Splunk Cloud issue

livehybrid — Wed, 09 Apr 2025 20:25:00 GMT

@isoutamo That is interesting, as I've found *more* IP changes on my customers with Victoria stacks than Classic stacks due to indexer scaling, however if you have a stable ingestion then I guess this shouldnt change much.