Currently we have an all On-Prem Splunk enterprise environment. From an administration perspective what is the differences if we move to a Splunk Cloud environment. What will be the differences in managing the deployment of apps? Any and all information is welcome. Thank you.
I am not a Cloud user, but did investigate moving in that direction. The key difference between Enterprise and Cloud is you have no control over the underlying infrastructure with Cloud. You can install and manage apps using the familiar GUI, but any changes to the platform (permissions changes, program installation, etc.) are done by Splunk support via a ticket.
As with any cloud service, there are also security considerations - that is, can Splunk Cloud still access all of your on-premises data sources.
You will be sending the data to the splunkcloud deployment using a splunk forwarder installed on your on-prem servers. So you not need to open your inbound access, only outbound ports to send data to the cloud servers.,
- if you have an app that uses a script to collect logs remotely using an API (ldap search, db connect, or AWS S3 monitoring by example), then the inputs collector may be on the cloud instance, and may require some firewall work.