Streaming data from local HEC to Splunk Cloud

[rasikmhetre]

I have successfully implemented this thing in my personal account and it works fine with the local HEC -> splunk cloud,  but in my organization's environment local HEC gives a successful response code but the indexer fails to index the data because HEC couldn't send data to Splunk cloud indexers. 

I noticed that I am not able to connect to the indexer's domain name or IP address on port 9997 do I need to explicitly allow any rule from Splunk cloud for indexers?

[rasikmhetre]

Thanks for your reply @inventsekar 

did you use the private IP or public IP? - it's public. 

I replicated the same thing in my personal account and it worked perfectly fine. I have already raised a support case but thought of posting on the community for a faster answer.

[inventsekar]

Hi @rasikmhetre ... You should be able to contact the Splunk Cloud Support and they should help you on almost all support related issues. 

> I noticed that I am not able to connect to the indexer's domain name or IP address on port 9997 do I need to explicitly allow any rule from Splunk cloud for indexers?

did you use the private ip or public ip?.. You could check with the Splunk Cloud Support for this task as well.