Getting Data In

What is the best practice for forwarding events to splunk cloud?

trojan_81
Path Finder

In a typical splunk cloud environment do logs get forwarded from onprem directly to the cloud indexer or is best practice to have some type of collector such as a heavy forwarder onprem which will collect and forward to the cloud indexer?

Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Best Practice is to forward events directly to Splunk Cloud. Intermediate forwarders can become a choke point, add a point of failure, add complexity, and are more to manage.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Best Practice is to forward events directly to Splunk Cloud. Intermediate forwarders can become a choke point, add a point of failure, add complexity, and are more to manage.

---
If this reply helps you, Karma would be appreciated.
0 Karma

trojan_81
Path Finder

Richgalloway,

Can you think of a use case (or is it even possible) for splunk cloud to query a heavy forwarder that is onprem?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Forwards (universal or heavy) are never queried. It's possible to send REST requests to a forwarder, but it's a good practice to disable the management port on forwarders to reduce the attack surface.

---
If this reply helps you, Karma would be appreciated.
0 Karma

trojan_81
Path Finder

makes sense now. thanks rich galloway

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...