Getting Data In

Is it better to send all the winevent logs in AWS instances to a HF in AWS and then forward those to our Splunk Cloud?

Dallastek1
Path Finder

WE have ALOT of aws instances with universal forwarders sending winevent logs and some are sending logs to an on prem HF. (before my time ). This isnt the kinesis aws logs going to splunk.

My question is this, would it be better to send all the winevent logs in our AWS instances to a heavy forwarder IN AWS and then forward those to our splunk cloud ?

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Funneling your UFs through an HF should be avoided unless doing so adds value for your organization.  In general intermediate HFs (IHF) add complexity and create a single point of failure. Usually, it's better for UFs to send directly to Splunk Cloud.

That said, yes, it may be more efficient to put the IHF in AWS, especially if you can put it in the same AWS region as your Splunk Cloud stack.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

Dallastek1
Path Finder

Thanks rich, I inherited this current environment and and just wanting to improve how we are getting data into our splunk cloud so im exploring different options.

richgalloway
SplunkTrust
SplunkTrust

Funneling your UFs through an HF should be avoided unless doing so adds value for your organization.  In general intermediate HFs (IHF) add complexity and create a single point of failure. Usually, it's better for UFs to send directly to Splunk Cloud.

That said, yes, it may be more efficient to put the IHF in AWS, especially if you can put it in the same AWS region as your Splunk Cloud stack.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...