Log forwarding from HF to Cloud

[b_chris21]

Hello,

I am collecting logs from various endpoints via UFs into a Splunk HF.

One of the data inputs is firewall logs via Syslog on port 514. 

My question is:

Will I have to set Data Input on port 514 on Splunk Cloud too? Or all logs will be globally forwarded on port 9997 which is already set?

Thanks!

[Stefanie · Accepted solution]

The logs will be forwarded from the HF to Splunk Cloud on port 9997.