How do I get the IP addresses for my Indexers in Splunk Cloud?

[pdaigle_splunk]

I went to provide my Security team the FQDN's of all the Indexers from the outputs.conf file provided by my Splunk Cloud Universal Forwarder app, but they told me they can only use IP addresses and not FQDN's.

1. Is there a way to obtain these IP addresses?
2. Do these IP addresses for the Indexers ever change?

[pdaigle_splunk · Accepted solution]

According to Splunk's latest Splunk Cloud management process (as of the date of this post), the IP addresses won’t change for the Splunk Cloud Indexers, even if one of those Indexers are rebuilt. This means whatever IP address is associated right now with your Splunk Cloud Indexer is what IP address it will be going on for as long as the customer owns this Splunk Cloud instance. When you add capacity to this Splunk Cloud instance you will then need to re-run the dig/nslookup command to get the IP addresses of the new Splunk Cloud Indexers that were added to the Splunk Cloud instance/stack.

Each of the inputs records are configured as DNS round-robin to the Splunk Cloud Indexers and is configured as such to support load balancing across the Splunk Cloud Indexing layer and expansion (as needed) without requiring endpoint changes. Hence the IP addressed associated with FQDN’s will be duplicated throughout the list of Splunk Cloud Indexers. This means you can reduce the number of IP addresses to open the TCP port 9997 to significantly.

Use this nice “for loop” to get the IP addresses you need to request for your TCP port 9997 allowed outbound to the Splunk Cloud instance for all of the Splunk Cloud Indexers:

for i in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15; do dig +short inputs$i..splunkcloud.com; done |sort -u

Where, "" is replaced with the Splunk Cloud stackID of your Splunk Cloud instance.