topic Re: Forwarder send data to http event collector in Splunk Enterprise

Forwarder send data to http event collector

kochera — Mon, 12 Jun 2017 06:57:11 GMT

Hi,

we would like to forward all data from a splunk instance in the "cloud" to an on-premise http event collector. Is there a way of doing this?

cheers,
Andy

Re: Forwarder send data to http event collector

esix_splunk — Mon, 12 Jun 2017 07:32:15 GMT

If you wanted to send to HEC, you'd basically have to export the search results to file, and then post those to the HEC endpoint.

If you're sending Splunk-2-Splunk, why are you wanting to use HEC? You can add and outputs on one of your "Cloud Instances" that points to your on-premise Splunk, and selectively forward data.. Check out the Routing and Filtering of data : http://docs.splunk.com/Documentation/Splunk/6.6.1/Forwarding/Routeandfilterdatad

Re: Forwarder send data to http event collector

kochera — Mon, 12 Jun 2017 07:46:26 GMT

Hi,
the reason why we want to use HEC is that we don't want to open additonal tcp ports towards our on-premise Splunk instance.

cheers,
Andy

Re: Forwarder send data to http event collector

woodcock — Tue, 13 Jun 2017 11:45:51 GMT

You can send S2S (splunk-to-splunk) over any port that you like so what I would do is just use this, but use your preferred port instead of the default of 9997:

https://docs.splunk.com/Documentation/Splunk/6.6.1/Indexer/Forwardmasterdata
I am assuming that when you say "splunk instance" that you mean "splunk indexer" but if you just mean "splunk forwarder" then again, you can do the same thing in outputs.conf but you will also have to do a similar thing in inputs.conf for your receiving Splunk indexers to receive it.

Re: Forwarder send data to http event collector

kochera — Tue, 13 Jun 2017 11:58:25 GMT

Hi,
we already have a HEC up and running and this is the only service we want to expose.

cheers,
Andy