Splunk Cloud Platform

Splunk Cloud use static IP?

Michael_Carlisl
Explorer

I've noticed that in our splunkd.log file it will time out using the FQDN that comes with our spl file. It eventually finds an IP address to connect to (although it shoots out a lot of warnings that it cannot connect at first) and everything works fine. We have a FreeBSD instance that is never able to forward using the FQDN, and ONLY works with the IP address. The problem is that the IP seems to not be static, so whenever that IP changes, our forwarder stops working. Has anyone seen this before or know of a solution?

Best,
Michael

Tags (1)
0 Karma

esix_splunk
Splunk Employee
Splunk Employee

Splunk Cloud instances are behind Elastic Load Balancers (ELB.) And depending on if you have a Single Instance or a Managed (Clustered stack), there is potential for IP addresses to be changed.

This means they are not static, nor can they be. (For the indexer(s).)

LGuinn's solution is best. However, I would be more concerned with why your instance isnt able to perform basic network name resolution. How does it access other services?

0 Karma

lguinn2
Legend

You could create an intermediate forwarder to connect to the Splunk Cloud. Have any "problematic" forwarders like your FreeBSD instance connect to the intermediate forwarder. The intermediate forwarder can be a Universal Forwarder, which creates less overhead than a heavy forwarder.

You might also open a support ticket and find out if you can get a static IP address assigned.

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!