Solved: Re: Pull syslog data from EC2 instance into Splunk

olgamirth · ‎07-25-2018

We're running an on-prem instance of Splunk Enterprise behind a firewall which (currently) does not permit ingress on ports 9996 or 9997. As such, I can't get EC2 syslog data in using the UF. Is it possible to get our on-prem instance of Splunk to pull the syslog data, in something close to real-time, from the EC2 instance. Is there a better way to architect this or should I just resign myself to do battle with our network administrators?

Thanks,
Mike

jplumsdaine22 · ‎07-26-2018

If they will only let you communicate TO AWS, then run an indexer in AWS, and peer your on prem search head with the AWS indexer.

View solution in original post

jplumsdaine22 · ‎07-26-2018

If they will only let you communicate TO AWS, then run an indexer in AWS, and peer your on prem search head with the AWS indexer.

olgamirth · ‎07-26-2018

Oh, hey! I didn't think of that. Thanks!

Pull syslog data from EC2 instance into Splunk

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

All Work and No Play? Not at .conf26! Unwind at These Evening Events

Join the Hackathon at .conf26 and build a No-Code AI agent

Join the Conversation