How to get data into Splunk without a universal forwarder

[rob_gibson]

I have an on-prem splunk enterprise installation, consisting exclusively of Universal forwarders and a single Indexer.

We now have a cloud-hosted environment, that it restricted, as it is hosted by an external company.  They do not allow us to install any software (but their own) on the servers.

Is there any way to get data into my Indexer, without a forwarder?

Without a forwarder, am I able to apply allow/deny lists to events?

[gcusello]

Hi @marnall ,

the solution depends on two factors:

1) the type of server:

if it's a Linux Server, you can use a syslog or (as @marnall sais, an HEC.

If Windows is a little more difficoult because you cannot use syslog; you could use WMI, even if I don't like it.

2) the type of logs you have to ingest (operative system, application)?

If application, maybe it has a sislog sending monitoring feature and you can use it.

Ciao.

Giuseppe

[marnall]

Does the cloud-hosted environment have any kind of log export functionality? It may be possible to configure it to send logs to the Splunk HTTP Event Collector.

Or, instead of pushing the logs, you can pull the logs using an API if it is offered by your cloud-hosted environment.

[rob_gibson]

Does the HEC support allow/deny for specific event types?  We have a LOT of data that we do not want to capture/forward from the cloud.

[marnall]

That isn't specifically a HEC functionality, but Splunk can be configured with props and transforms to discard unwanted data by sending it to the nullQueue before indexing. This will consume network bandwidth from sending the data from the cloud to splunk, but will not count the discarded logs against your Splunk license.