Deployment Architecture

Heavy Forwarder to Splunk Cloud via Socks Proxy

andrewparkes
Loves-to-Learn

Hi,

 

We have a project to implement splunk so that it talks out to splunk cloud, via a proxy server.

To do this, i believe we need to configure the heavy forwarder to connect to the proxy using socks5, port 1080, as per this article: 

https://docs.splunk.com/Documentation/Splunk/9.0.2/Forwarding/ConfigureaforwardertouseaSOCKSproxy

I beleive i've done this correctly, i think, and we also think the proxy is configured correctly. Yet we aren't seeing the data flow into splunk.

 

Am i missing something with the config on the forwarder, or is it really just as that article presents it? Looking in the deployment server, i can see the test endpoints we've added are visible, so all that seems to be working, its now getting this out and into the cloud we need.

 

All new to me splunk, so trying to work it out on the fly, therefore an pointers in the right direction would be appreciated

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...