Splunk Enterprise

Forwarder send data to http event collector

kochera
Communicator

Hi,

we would like to forward all data from a splunk instance in the "cloud" to an on-premise http event collector. Is there a way of doing this?

cheers,
Andy

Tags (1)
0 Karma
1 Solution

esix_splunk
Splunk Employee
Splunk Employee

If you wanted to send to HEC, you'd basically have to export the search results to file, and then post those to the HEC endpoint.

If you're sending Splunk-2-Splunk, why are you wanting to use HEC? You can add and outputs on one of your "Cloud Instances" that points to your on-premise Splunk, and selectively forward data.. Check out the Routing and Filtering of data : http://docs.splunk.com/Documentation/Splunk/6.6.1/Forwarding/Routeandfilterdatad

View solution in original post

0 Karma

woodcock
Esteemed Legend

You can send S2S (splunk-to-splunk) over any port that you like so what I would do is just use this, but use your preferred port instead of the default of 9997:

https://docs.splunk.com/Documentation/Splunk/6.6.1/Indexer/Forwardmasterdata
I am assuming that when you say "splunk instance" that you mean "splunk indexer" but if you just mean "splunk forwarder" then again, you can do the same thing in outputs.conf but you will also have to do a similar thing in inputs.conf for your receiving Splunk indexers to receive it.

0 Karma

kochera
Communicator

Hi,
we already have a HEC up and running and this is the only service we want to expose.

cheers,
Andy

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

If you wanted to send to HEC, you'd basically have to export the search results to file, and then post those to the HEC endpoint.

If you're sending Splunk-2-Splunk, why are you wanting to use HEC? You can add and outputs on one of your "Cloud Instances" that points to your on-premise Splunk, and selectively forward data.. Check out the Routing and Filtering of data : http://docs.splunk.com/Documentation/Splunk/6.6.1/Forwarding/Routeandfilterdatad

0 Karma

kochera
Communicator

Hi,
the reason why we want to use HEC is that we don't want to open additonal tcp ports towards our on-premise Splunk instance.

cheers,
Andy

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...