Network traffic flow integration with Splunk Cloud

[camieya2017]

I currently have Splunk Enterprise on prem and want to move to the Cloud. Do we have to have a separate syslog server to collect all network traffic and have forwarders to send them to Splunk cloud instance? What other ways I can send the network traffic flow to Splunk cloud instance?

[nickhills · Accepted solution]

Yes - you would want to locate a heavy forwarder/syslog reciver on your local environment to agregate logs, and send them to Splunk Cloud, or install a Universal Forwarder on each host to collect the local syslog.

Commonly, you may do both, and combine with a deployment server to manage all you local UF and HF Splunk components.

[camieya2017]

Thank you for your answer. We are currently moving out of the data center and migrating to azure environment. Do you have a recommendation where we should have a syslog (deployment) server? internal network or dmz, behind firewall on separate domain? The whole point for moving to Splunk Cloud was to avoid to have splunk enterprise on azure. Any recommendations? Thank you so much in advance.

[nickhills]

If your network segregation is based on zones (and by which, i mean only your DMZ can access the internet) then I would locate your HF inside the DMZ.
I would probably locate the DS on the internal network.