Splunk Cloud Platform

Network traffic flow integration with Splunk Cloud

camieya2017
New Member

I currently have Splunk Enterprise on prem and want to move to the Cloud. Do we have to have a separate syslog server to collect all network traffic and have forwarders to send them to Splunk cloud instance? What other ways I can send the network traffic flow to Splunk cloud instance?

0 Karma
1 Solution

nickhills
Ultra Champion

Yes - you would want to locate a heavy forwarder/syslog reciver on your local environment to agregate logs, and send them to Splunk Cloud, or install a Universal Forwarder on each host to collect the local syslog.

Commonly, you may do both, and combine with a deployment server to manage all you local UF and HF Splunk components.

If my comment helps, please give it a thumbs up!

View solution in original post

0 Karma

nickhills
Ultra Champion

Yes - you would want to locate a heavy forwarder/syslog reciver on your local environment to agregate logs, and send them to Splunk Cloud, or install a Universal Forwarder on each host to collect the local syslog.

Commonly, you may do both, and combine with a deployment server to manage all you local UF and HF Splunk components.

If my comment helps, please give it a thumbs up!
0 Karma

camieya2017
New Member

Thank you for your answer. We are currently moving out of the data center and migrating to azure environment. Do you have a recommendation where we should have a syslog (deployment) server? internal network or dmz, behind firewall on separate domain? The whole point for moving to Splunk Cloud was to avoid to have splunk enterprise on azure. Any recommendations? Thank you so much in advance.

0 Karma

nickhills
Ultra Champion

If your network segregation is based on zones (and by which, i mean only your DMZ can access the internet) then I would locate your HF inside the DMZ.
I would probably locate the DS on the internal network.

If my comment helps, please give it a thumbs up!
0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...