Logs to local Hfs if on corp network else send to Cloud

[rene_securelink]

Laptop sends log to local HFs if connected to corp network - otherwise send logs to Splunk Cloud.
Data should not end up redundant on the indexers.

Is it possible to have this configured?

[woodcock]

The easiest way is to have both the HFs and the cloud indexers in your outputs.conf. The problem with this is that it does not prefer the HFs over cloud.

[woodcock]

Pretty much anything else is going to result in logs both places at least sometimes.

[gcusello · Accepted solution]

Hi rene_securelink,
I don't know if could be acceptable for you, but if you could configure outputs.conf of your Laptop's Forwarder to send logs both to HFs and Splunk Cloud.
In this way, you send to Splunk Cloud when you're aren't connected to the corp network and to the HFs and Splunk Cloud when you're connected to the corp network.

Bye.
Giuseppe

[rene_securelink]

Hi Giuseppe,
Thanks for the answer - one question if using 2 groups.
For Cloud there is an certificate to be used. Could that not cause an issue for the internal HFs as it will not be the same?
Or will each group use it's own certificate?

[tcpout]
defaultgroup = internalhf

[tcpout:internalhf]
server = hf1,hf2
sslCertpath = xyz
sslRootCApath = xyz
sslPassword = xyz

[tcpout:cloud]
server = cloud1,cloud2
sslCertpath = abc
sslRootCApath = abc
sslPassword = abc

Thanks in advance
René

[gcusello]

Hi rene_securelink,
in the same outputs.conf you have to merge two configuration:

• one for cloud,
• one for HFs.

in each section you have to use the options that you're already using: in other words, if you use SSL you have to use, if not you don't need.

you can have more certificates.

Bye.
Giuseppe

[gcusello]

Hi rene_securelink,
if this answer satisfies your need, please accept and/or upvote it.
Bye.
Giuseppe

[DavidHourani]

Yes ! And combine that with strict IP filters on the inputs for both the HF and splunk cloud receiving end 😉