https://community.splunk.com/t5/Getting-Data-In/Pull-syslog-data-from-EC2-instance-into-Splunk/m-p/459751#M79394 <P>If they will only let you communicate TO AWS, then run an indexer in AWS, and peer your on prem search head with the AWS indexer. </P> Thu, 26 Jul 2018 12:46:01 GMT jplumsdaine22 2018-07-26T12:46:01Z https://community.splunk.com/t5/Getting-Data-In/Pull-syslog-data-from-EC2-instance-into-Splunk/m-p/459750#M79393 <P>We're running an on-prem instance of Splunk Enterprise behind a firewall which (currently) does not permit ingress on ports 9996 or 9997. As such, I can't get EC2 syslog data in using the UF. Is it possible to get our on-prem instance of Splunk to <EM>pull</EM> the syslog data, in something close to real-time, from the EC2 instance. Is there a better way to architect this or should I just resign myself to do battle with our network administrators?</P> <P>Thanks,<BR /> Mike</P> Wed, 25 Jul 2018 14:12:05 GMT https://community.splunk.com/t5/Getting-Data-In/Pull-syslog-data-from-EC2-instance-into-Splunk/m-p/459750#M79393 olgamirth 2018-07-25T14:12:05Z https://community.splunk.com/t5/Getting-Data-In/Pull-syslog-data-from-EC2-instance-into-Splunk/m-p/459751#M79394 <P>If they will only let you communicate TO AWS, then run an indexer in AWS, and peer your on prem search head with the AWS indexer. </P> Thu, 26 Jul 2018 12:46:01 GMT https://community.splunk.com/t5/Getting-Data-In/Pull-syslog-data-from-EC2-instance-into-Splunk/m-p/459751#M79394 jplumsdaine22 2018-07-26T12:46:01Z https://community.splunk.com/t5/Getting-Data-In/Pull-syslog-data-from-EC2-instance-into-Splunk/m-p/459752#M79395 <P>Oh, hey! I didn't think of that. Thanks!</P> Thu, 26 Jul 2018 13:59:47 GMT https://community.splunk.com/t5/Getting-Data-In/Pull-syslog-data-from-EC2-instance-into-Splunk/m-p/459752#M79395 olgamirth 2018-07-26T13:59:47Z