How to go about File Monitoring for servers in cloud?

[tonysmith8583]

We have some servers that are deployed in AWS and we want to monitor some files that are on them.  Typically, I'd go with the UF, but in this case our indexers only have private IPs.  We do have some Heavy Forwarders that can be publicly addressed.  We have only used that for HEC though.  The Heavy Forwarders do have receiving set up on port 9997, but wouldn't that inde the data locally on the servers?

Have any of you had a similar issue?

We have a clustered on prem enviroment BTW.

[richgalloway]

Port 9997 is used for the Splunk-to-Splunk protocol. It doesn't specify where the data goes as that is controlled by the outputs.conf file.  If the instance is a HF then it must have an outputs.conf file so all data it gets, regardless of the port, will be sent to your indexers.