Splunk Cloud use static IP?

[Michael_Carlisl]

I've noticed that in our splunkd.log file it will time out using the FQDN that comes with our spl file. It eventually finds an IP address to connect to (although it shoots out a lot of warnings that it cannot connect at first) and everything works fine. We have a FreeBSD instance that is never able to forward using the FQDN, and ONLY works with the IP address. The problem is that the IP seems to not be static, so whenever that IP changes, our forwarder stops working. Has anyone seen this before or know of a solution?

Best,
Michael

[esix_splunk]

Splunk Cloud instances are behind Elastic Load Balancers (ELB.) And depending on if you have a Single Instance or a Managed (Clustered stack), there is potential for IP addresses to be changed.

This means they are not static, nor can they be. (For the indexer(s).)

LGuinn's solution is best. However, I would be more concerned with why your instance isnt able to perform basic network name resolution. How does it access other services?

[lguinn2]

You could create an intermediate forwarder to connect to the Splunk Cloud. Have any "problematic" forwarders like your FreeBSD instance connect to the intermediate forwarder. The intermediate forwarder can be a Universal Forwarder, which creates less overhead than a heavy forwarder.

You might also open a support ticket and find out if you can get a static IP address assigned.