Need Guidance on OCI Log Integration with Splunk On-Premises (HEC Connectivity Issue)

[Thirugangt]

Hi Team,

We are trying to integrate Oracle Cloud Infrastructure (OCI) logs with our Splunk Enterprise On-Premises environment.

Environment:

• Splunk Enterprise On-Premises
• Heavy Forwarder (HF) hosted in the internal network
• HEC is configured on the Heavy Forwarder
• The HF is not located in the DMZ
• OCI needs to send logs from the public cloud to our on-premises Splunk environment

Issue:

Since our Heavy Forwarder is hosted behind the internal firewall and is not exposed to the internet, OCI cannot access our HEC endpoint. Due to our organization's security policy, we cannot expose the HEC endpoint to the public internet or move the Heavy Forwarder to the DMZ.

Additionally, we found that the official OCI Splunk Add-on has been archived, so we are looking for an alternative supported solution.

We would appreciate guidance on the following:

1. What is the recommended architecture for integrating OCI logs with Splunk On-Premises when HEC cannot be exposed externally?
2. Has anyone implemented this integration in a similar environment where the Splunk infrastructure is completely internal?
3. Are there any best practices or reference architectures for this scenario?

[Thirugangt · Accepted solution]

Hi Thanks for your update!

We tried the same add-on, but the GUI is not working, and we are unable to complete the configuration.

[PickleRick]

OK, it does seem that the add-on is a bit outdated (among other things, the installation tab on Splunkbase points to a non-existing link for OCI Splunk Logging plugin.

You might want to look into  https://github.com/splunk/Splunk-Addon-for-OCI/issues/15 - if you're using Splunk version which still supports Python 3.7, you might be able to force it to run for now.

[PickleRick]

Which add-on have you tried? As I understand, https://splunkbase.splunk.com/app/5222 is "the right one". True, it's archived but that doesn't automatically mean that it won't work. It's just that noone has made any updates to it so that it just got autoarchived.

Also while I'm no expert on OCI, the description for that app highly suggests that it works on a "pull" basis so no exposing ports to an outside world should be needed.