Getting Data In
Highlighted

What is the best practice for forwarding events to splunk cloud?

Explorer

In a typical splunk cloud environment do logs get forwarded from onprem directly to the cloud indexer or is best practice to have some type of collector such as a heavy forwarder onprem which will collect and forward to the cloud indexer?

Tags (2)
0 Karma
Highlighted

Re: What is the best practice for forwarding events to splunk cloud?

SplunkTrust
SplunkTrust

Best Practice is to forward events directly to Splunk Cloud. Intermediate forwarders can become a choke point, add a point of failure, add complexity, and are more to manage.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma
Highlighted

Re: What is the best practice for forwarding events to splunk cloud?

Explorer

Richgalloway,

Can you think of a use case (or is it even possible) for splunk cloud to query a heavy forwarder that is onprem?

0 Karma
Highlighted

Re: What is the best practice for forwarding events to splunk cloud?

SplunkTrust
SplunkTrust

Forwards (universal or heavy) are never queried. It's possible to send REST requests to a forwarder, but it's a good practice to disable the management port on forwarders to reduce the attack surface.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: What is the best practice for forwarding events to splunk cloud?

Explorer

makes sense now. thanks rich galloway

0 Karma