how to get the Splunk Cloud IP's for whitelisting

[Jeewan]

if we have to allow or whitelist the Splunk cloud IP's somewhere how to get the Splunk Cloud IP's for whitelisting ? 

are these IP's are static ?

is there any fix range of IP's Splunk uses for Splunk Cloud so we can use those for whitelisting

[livehybrid]

Are you referring to the indexers for S2S forwarding, or something else such as HEC, UI or REST API access?
If you are looking for your indexer IPs then you may be able to resolve the DNS names in the outputs.conf file as @gcusello suggested and then deduplicate the results, however be aware that these IPs can change if Splunk scales the number of Indexers in operation within your stack or if any indexers require rebuilding.

Other than rare occasions where SH are rebuilt, these are generally fixed IPs which you wouldnt expect to change often. Looking in your _internal index you can find a list of hosts in the format sh*.splunkcloud.com which you can resolve to provide your list of SH IP addresses for REST access if required.

[Jeewan]

@livehybrid @gcusello  My requirement is I have to send events via Alert_Webhook. So we need to allow the Sender IP (in My case -Splunk Cloud)  at the receiving end of the webhook. What IP do we need to whitelist and where do we get that IP from?

[gcusello]

Hi @Jeewan ,

downloading the UniversalForwarder App from your Splunk Cloud instance, there's the outputs.conf file in which you should find the Splunk Cloud IPs of your instance.

Ciao.

Giuseppe