All Apps and Add-ons

Streaming data from local HEC to Splunk Cloud

rasikmhetre
Explorer

I have successfully implemented this thing in my personal account and it works fine with the local HEC -> splunk cloud,  but in my organization's environment local HEC gives a successful response code but the indexer fails to index the data because HEC couldn't send data to Splunk cloud indexers. 

 

I noticed that I am not able to connect to the indexer's domain name or IP address on port 9997 do I need to explicitly allow any rule from Splunk cloud for indexers?

Labels (1)
Tags (1)
0 Karma

rasikmhetre
Explorer

Thanks for your reply @inventsekar 

did you use the private IP or public IP? - it's public. 

I replicated the same thing in my personal account and it worked perfectly fine. I have already raised a support case but thought of posting on the community for a faster answer.

0 Karma

inventsekar
SplunkTrust
SplunkTrust

Hi @rasikmhetre ... You should be able to contact the Splunk Cloud Support and they should help you on almost all support related issues. 

 

> I noticed that I am not able to connect to the indexer's domain name or IP address on port 9997 do I need to explicitly allow any rule from Splunk cloud for indexers?

did you use the private ip or public ip?.. You could check with the Splunk Cloud Support for this task as well. 

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...