Getting Data In

What is the best practice for forwarding events to splunk cloud?

trojan_81
Path Finder

In a typical splunk cloud environment do logs get forwarded from onprem directly to the cloud indexer or is best practice to have some type of collector such as a heavy forwarder onprem which will collect and forward to the cloud indexer?

Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Best Practice is to forward events directly to Splunk Cloud. Intermediate forwarders can become a choke point, add a point of failure, add complexity, and are more to manage.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Best Practice is to forward events directly to Splunk Cloud. Intermediate forwarders can become a choke point, add a point of failure, add complexity, and are more to manage.

---
If this reply helps you, Karma would be appreciated.
0 Karma

trojan_81
Path Finder

Richgalloway,

Can you think of a use case (or is it even possible) for splunk cloud to query a heavy forwarder that is onprem?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Forwards (universal or heavy) are never queried. It's possible to send REST requests to a forwarder, but it's a good practice to disable the management port on forwarders to reduce the attack surface.

---
If this reply helps you, Karma would be appreciated.
0 Karma

trojan_81
Path Finder

makes sense now. thanks rich galloway

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...