Firehose to Splunk Cloud

[bonf_bhai]

Has anybody implemented Firehose to Splunk cloud destination? Was wondering how the connection is made and if it can be routed thru a proxy in between. Have some network guys questioning this before we decide on firehose as a solution. Any pointers to documentation/blogs will be helpful! Thank you!

[alonsocaio]

Hi @bonf_bhai,

I guess you would have to use Splunk HTTP Event Collector to receive logs from Firehose.

You can find more information about this integration on the following docs: ConfigureFirehose and create-destination-splunk .

Also, as expose into the docs, It seems to be possible to send data using a proxy:

If you are on a distributed Splunk Enterprise deployment, enter the URL and port of your data receiver node.
For example, if you have an ELB that proxies traffic to your indexers with DNS name example-test-123456789.us-east-1.elb.amazonaws.com and port 443, enter https://example-test-123456789.us-east-1.elb.amazonaws.com:443.
If you want to send data directly to multiple Splunk indexers acting as your data collection nodes, you need a URL that resolves to multiple IP addresses (one for each node) with the port enabled for HTTP event collector on those nodes.
For example, if the hostname that resolves to your indexers is inputs.example-deployment.com, enter https://inputs.example-deployment.com:8088.