https://community.splunk.com/t5/Getting-Data-In/What-is-the-best-practice-for-forwarding-events-to-splunk-cloud/m-p/496364#M84668 <P>In a typical splunk cloud environment do logs get forwarded from onprem directly to the cloud indexer or is best practice to have some type of collector such as a heavy forwarder onprem which will collect and forward to the cloud indexer?</P> Mon, 16 Mar 2020 14:59:18 GMT trojan_81 2020-03-16T14:59:18Z https://community.splunk.com/t5/Getting-Data-In/What-is-the-best-practice-for-forwarding-events-to-splunk-cloud/m-p/496364#M84668 <P>In a typical splunk cloud environment do logs get forwarded from onprem directly to the cloud indexer or is best practice to have some type of collector such as a heavy forwarder onprem which will collect and forward to the cloud indexer?</P> Mon, 16 Mar 2020 14:59:18 GMT https://community.splunk.com/t5/Getting-Data-In/What-is-the-best-practice-for-forwarding-events-to-splunk-cloud/m-p/496364#M84668 trojan_81 2020-03-16T14:59:18Z https://community.splunk.com/t5/Getting-Data-In/What-is-the-best-practice-for-forwarding-events-to-splunk-cloud/m-p/496365#M84669 <P>Best Practice is to forward events directly to Splunk Cloud. Intermediate forwarders can become a choke point, add a point of failure, add complexity, and are more to manage.</P> Mon, 16 Mar 2020 15:34:45 GMT https://community.splunk.com/t5/Getting-Data-In/What-is-the-best-practice-for-forwarding-events-to-splunk-cloud/m-p/496365#M84669 richgalloway 2020-03-16T15:34:45Z https://community.splunk.com/t5/Getting-Data-In/What-is-the-best-practice-for-forwarding-events-to-splunk-cloud/m-p/496366#M84670 <P>Richgalloway,</P> <P>Can you think of a use case (or is it even possible) for splunk cloud to query a heavy forwarder that is onprem? </P> Mon, 16 Mar 2020 16:00:31 GMT https://community.splunk.com/t5/Getting-Data-In/What-is-the-best-practice-for-forwarding-events-to-splunk-cloud/m-p/496366#M84670 trojan_81 2020-03-16T16:00:31Z https://community.splunk.com/t5/Getting-Data-In/What-is-the-best-practice-for-forwarding-events-to-splunk-cloud/m-p/496367#M84671 <P>Forwards (universal or heavy) are never queried. It's possible to send REST requests to a forwarder, but it's a good practice to disable the management port on forwarders to reduce the attack surface.</P> Mon, 16 Mar 2020 19:50:32 GMT https://community.splunk.com/t5/Getting-Data-In/What-is-the-best-practice-for-forwarding-events-to-splunk-cloud/m-p/496367#M84671 richgalloway 2020-03-16T19:50:32Z https://community.splunk.com/t5/Getting-Data-In/What-is-the-best-practice-for-forwarding-events-to-splunk-cloud/m-p/496368#M84672 <P>makes sense now. thanks rich galloway</P> Mon, 16 Mar 2020 19:58:27 GMT https://community.splunk.com/t5/Getting-Data-In/What-is-the-best-practice-for-forwarding-events-to-splunk-cloud/m-p/496368#M84672 trojan_81 2020-03-16T19:58:27Z