topic Logs to local Hfs if on corp network else send to Cloud in Getting Data In

Logs to local Hfs if on corp network else send to Cloud

rene_securelink — Wed, 28 Aug 2019 12:01:53 GMT

Laptop sends log to local HFs if connected to corp network - otherwise send logs to Splunk Cloud.
Data should not end up redundant on the indexers.

Is it possible to have this configured?

Re: Logs to local Hfs if on corp network else send to Cloud

gcusello — Wed, 28 Aug 2019 13:11:40 GMT

Hi rene_securelink,
I don't know if could be acceptable for you, but if you could configure outputs.conf of your Laptop's Forwarder to send logs both to HFs and Splunk Cloud.
In this way, you send to Splunk Cloud when you're aren't connected to the corp network and to the HFs and Splunk Cloud when you're connected to the corp network.

Bye.
Giuseppe

Re: Logs to local Hfs if on corp network else send to Cloud

DavidHourani — Wed, 28 Aug 2019 13:54:30 GMT

Yes ! And combine that with strict IP filters on the inputs for both the HF and splunk cloud receiving end 😉

Re: Logs to local Hfs if on corp network else send to Cloud

rene_securelink — Fri, 30 Aug 2019 11:11:34 GMT

Hi Giuseppe,
Thanks for the answer - one question if using 2 groups.
For Cloud there is an certificate to be used. Could that not cause an issue for the internal HFs as it will not be the same?
Or will each group use it's own certificate?

[tcpout]
defaultgroup = internalhf

[tcpout:internalhf]
server = hf1,hf2
sslCertpath = xyz
sslRootCApath = xyz
sslPassword = xyz

[tcpout:cloud]
server = cloud1,cloud2
sslCertpath = abc
sslRootCApath = abc
sslPassword = abc

Thanks in advance
René

Re: Logs to local Hfs if on corp network else send to Cloud

gcusello — Fri, 30 Aug 2019 12:39:22 GMT

Hi rene_securelink,
in the same outputs.conf you have to merge two configuration:

one for cloud,
one for HFs.

in each section you have to use the options that you're already using: in other words, if you use SSL you have to use, if not you don't need.

you can have more certificates.

Bye.
Giuseppe

Re: Logs to local Hfs if on corp network else send to Cloud

woodcock — Sun, 01 Sep 2019 20:26:19 GMT

The easiest way is to have both the HFs and the cloud indexers in your outputs.conf. The problem with this is that it does not prefer the HFs over cloud.

Re: Logs to local Hfs if on corp network else send to Cloud

woodcock — Sun, 01 Sep 2019 20:27:57 GMT

Pretty much anything else is going to result in logs both places at least sometimes.

Re: Logs to local Hfs if on corp network else send to Cloud

gcusello — Mon, 02 Sep 2019 07:03:45 GMT

Hi rene_securelink,
if this answer satisfies your need, please accept and/or upvote it.
Bye.
Giuseppe