All Apps and Add-ons

Streaming data from local HEC to Splunk Cloud

rasikmhetre
Explorer

I have successfully implemented this thing in my personal account and it works fine with the local HEC -> splunk cloud,  but in my organization's environment local HEC gives a successful response code but the indexer fails to index the data because HEC couldn't send data to Splunk cloud indexers. 

 

I noticed that I am not able to connect to the indexer's domain name or IP address on port 9997 do I need to explicitly allow any rule from Splunk cloud for indexers?

Labels (1)
Tags (1)
0 Karma

rasikmhetre
Explorer

Thanks for your reply @inventsekar 

did you use the private IP or public IP? - it's public. 

I replicated the same thing in my personal account and it worked perfectly fine. I have already raised a support case but thought of posting on the community for a faster answer.

0 Karma

inventsekar
SplunkTrust
SplunkTrust

Hi @rasikmhetre ... You should be able to contact the Splunk Cloud Support and they should help you on almost all support related issues. 

 

> I noticed that I am not able to connect to the indexer's domain name or IP address on port 9997 do I need to explicitly allow any rule from Splunk cloud for indexers?

did you use the private ip or public ip?.. You could check with the Splunk Cloud Support for this task as well. 

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...