Getting Data In

What is the best practice for forwarding events to splunk cloud?

trojan_81
Path Finder

In a typical splunk cloud environment do logs get forwarded from onprem directly to the cloud indexer or is best practice to have some type of collector such as a heavy forwarder onprem which will collect and forward to the cloud indexer?

Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Best Practice is to forward events directly to Splunk Cloud. Intermediate forwarders can become a choke point, add a point of failure, add complexity, and are more to manage.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Best Practice is to forward events directly to Splunk Cloud. Intermediate forwarders can become a choke point, add a point of failure, add complexity, and are more to manage.

---
If this reply helps you, Karma would be appreciated.
0 Karma

trojan_81
Path Finder

Richgalloway,

Can you think of a use case (or is it even possible) for splunk cloud to query a heavy forwarder that is onprem?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Forwards (universal or heavy) are never queried. It's possible to send REST requests to a forwarder, but it's a good practice to disable the management port on forwarders to reduce the attack surface.

---
If this reply helps you, Karma would be appreciated.
0 Karma

trojan_81
Path Finder

makes sense now. thanks rich galloway

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...