Splunk Cloud Platform

Network traffic flow integration with Splunk Cloud

camieya2017
New Member

I currently have Splunk Enterprise on prem and want to move to the Cloud. Do we have to have a separate syslog server to collect all network traffic and have forwarders to send them to Splunk cloud instance? What other ways I can send the network traffic flow to Splunk cloud instance?

0 Karma
1 Solution

nickhills
Ultra Champion

Yes - you would want to locate a heavy forwarder/syslog reciver on your local environment to agregate logs, and send them to Splunk Cloud, or install a Universal Forwarder on each host to collect the local syslog.

Commonly, you may do both, and combine with a deployment server to manage all you local UF and HF Splunk components.

If my comment helps, please give it a thumbs up!

View solution in original post

0 Karma

nickhills
Ultra Champion

Yes - you would want to locate a heavy forwarder/syslog reciver on your local environment to agregate logs, and send them to Splunk Cloud, or install a Universal Forwarder on each host to collect the local syslog.

Commonly, you may do both, and combine with a deployment server to manage all you local UF and HF Splunk components.

If my comment helps, please give it a thumbs up!
0 Karma

camieya2017
New Member

Thank you for your answer. We are currently moving out of the data center and migrating to azure environment. Do you have a recommendation where we should have a syslog (deployment) server? internal network or dmz, behind firewall on separate domain? The whole point for moving to Splunk Cloud was to avoid to have splunk enterprise on azure. Any recommendations? Thank you so much in advance.

0 Karma

nickhills
Ultra Champion

If your network segregation is based on zones (and by which, i mean only your DMZ can access the internet) then I would locate your HF inside the DMZ.
I would probably locate the DS on the internal network.

If my comment helps, please give it a thumbs up!
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...