Heavy Forwarder to Splunk Cloud issue

[Alan_Chan]

I am using Heavy Forwarder to forward log to Splunk cloud, when I installed the splunkclouduf.spl to splunk 

autoloadbalancedconnectionstrategy cooked connection to xxx.xxx.xxx.xxx:9997

May I know the IP address of Splunk Cloud Indexer and Search head are fixed or changeable? 

And for the firewall rule, should I use IP address or DNS to allow the traffic?

[isoutamo]

As already said you should use fqdn based fw opening to those dns names. 
In real life those ips are probably quite stable as long as you are using Victoria stack and don’t change its region. Based on this you could try to use ip based fw openings too, but time by time that could break your traffic if/when those ips have changed.

[livehybrid]

@isoutamo That is interesting, as I've found *more* IP changes on my customers with Victoria stacks than Classic stacks due to indexer scaling, however if you have a stable ingestion then I guess this shouldnt change much.

[livehybrid]

Hi

Splunk Cloud indexer IP addresses can change over time; they are not fixed as they may scale in/out or be replaced during upgrades.

Always use the provided DNS hostname (e.g., inputsXX.stackName.splunkcloud.com) for forwarding and firewall rules.

For firewall configuration, allow outbound traffic on port 9997 to the Splunk Cloud DNS hostname, not specific IPs. 

Splunk Cloud Search Heads IPs are less likely to change as they are updated less frequently but there is no guarantees that they will persist.

Some useful docs: https://docs.splunk.com/Documentation/SplunkCloud/latest/Service/SplunkCloudservice#Network_connecti...

🌟 Did this answer help you? If so, please consider:

• Adding kudos to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[kiran_panchavat]

@Alan_Chan 

The Cloud forwarder package/app contains DNS entries for the indexers in outputs.conf. This enables indexers to be replaced/scaled without the customer having to update outputs.conf

Refer this links

https://community.splunk.com/t5/Getting-Data-In/How-do-I-get-the-IP-addresses-for-my-Indexers-in-Spl... 

https://community.splunk.com/t5/Splunk-Search/I-want-IPs-for-Splunk-Cloud-indexers-for-firewall-rule...