topic Re: Need Guidance on OCI Log Integration with Splunk On-Premises (HEC Connectivity Issue) in Getting Data In

Need Guidance on OCI Log Integration with Splunk On-Premises (HEC Connectivity Issue)

Thirugangt — Sun, 12 Jul 2026 16:57:05 GMT

Hi Team,

We are trying to integrate Oracle Cloud Infrastructure (OCI) logs with our Splunk Enterprise On-Premises environment.

Environment:

Splunk Enterprise On-Premises
Heavy Forwarder (HF) hosted in the internal network
HEC is configured on the Heavy Forwarder
The HF is not located in the DMZ
OCI needs to send logs from the public cloud to our on-premises Splunk environment

Issue:

Since our Heavy Forwarder is hosted behind the internal firewall and is not exposed to the internet, OCI cannot access our HEC endpoint. Due to our organization's security policy, we cannot expose the HEC endpoint to the public internet or move the Heavy Forwarder to the DMZ.

Additionally, we found that the official OCI Splunk Add-on has been archived, so we are looking for an alternative supported solution.

We would appreciate guidance on the following:

What is the recommended architecture for integrating OCI logs with Splunk On-Premises when HEC cannot be exposed externally?
Has anyone implemented this integration in a similar environment where the Splunk infrastructure is completely internal?
Are there any best practices or reference architectures for this scenario?

Re: Need Guidance on OCI Log Integration with Splunk On-Premises (HEC Connectivity Issue)

PickleRick — Sun, 12 Jul 2026 21:16:09 GMT

Which add-on have you tried? As I understand, https://splunkbase.splunk.com/app/5222 is "the right one". True, it's archived but that doesn't automatically mean that it won't work. It's just that noone has made any updates to it so that it just got autoarchived.

Also while I'm no expert on OCI, the description for that app highly suggests that it works on a "pull" basis so no exposing ports to an outside world should be needed.

Re: Need Guidance on OCI Log Integration with Splunk On-Premises (HEC Connectivity Issue)

Thirugangt — Mon, 13 Jul 2026 04:27:17 GMT

Hi Thanks for your update!

We tried the same add-on, but the GUI is not working, and we are unable to complete the configuration.

Re: Need Guidance on OCI Log Integration with Splunk On-Premises (HEC Connectivity Issue)

PickleRick — Mon, 13 Jul 2026 07:13:59 GMT

OK, it does seem that the add-on is a bit outdated (among other things, the installation tab on Splunkbase points to a non-existing link for OCI Splunk Logging plugin.

You might want to look into https://github.com/splunk/Splunk-Addon-for-OCI/issues/15 - if you're using Splunk version which still supports Python 3.7, you might be able to force it to run for now.