Need Splunk Cloud Indexer URL to Allow in Firewall

[schua]

Hello,

I am new to Splunk Cloud and trying to configure Splunk Forwarder on one of the Linux boxes.

Here are the steps I did:
1. From the Splunk Cloud App-> Universal Forwarder, I downloaded and installed Universal Forwarder in the Linux box.
2. Downloaded and installed Universal Forwarder credentials successfully
3. restarted Splunk

My issue now is I have give instructions to my Network team to open port 9997 to Splunk Cloud indexer but I don't know where to get the URL(destination) of the indexer. Unlike Splunk Enterprise where you know the IP address of the server and put it in output.conf (server = serverIP:Port), I'm not sure where to get the URL.

Regards,
Sherwin

[gcusello · Accepted solution]

Hi @schua,
if you have to perform a test with one target server you need to open only port 9997 to Splunk Cloud public URL not to the Indexer's IP address.
You can use the same method to connect to Splunk Cloud as you would with an on premises version: you just need to use the global dns name for your stack that you can find in your Cloud instance main page.

But anyway, if you have more targets to monitor I suggest to use a more structured architecture, adding one or two (better to have HA features) Heavy Forwarder/s to use as log concentrator/s.
In this way you have to open firewall routes only from this/these server to Splunk Cloud and not from all the targets.

Ciao.
Giuseppe