Deployment Architecture

Heavy Forwarder to Splunk Cloud via Socks Proxy

andrewparkes
Loves-to-Learn

Hi,

 

We have a project to implement splunk so that it talks out to splunk cloud, via a proxy server.

To do this, i believe we need to configure the heavy forwarder to connect to the proxy using socks5, port 1080, as per this article: 

https://docs.splunk.com/Documentation/Splunk/9.0.2/Forwarding/ConfigureaforwardertouseaSOCKSproxy

I beleive i've done this correctly, i think, and we also think the proxy is configured correctly. Yet we aren't seeing the data flow into splunk.

 

Am i missing something with the config on the forwarder, or is it really just as that article presents it? Looking in the deployment server, i can see the test endpoints we've added are visible, so all that seems to be working, its now getting this out and into the cloud we need.

 

All new to me splunk, so trying to work it out on the fly, therefore an pointers in the right direction would be appreciated

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...