Forwarder send data to http event collector

[kochera]

Hi,

we would like to forward all data from a splunk instance in the "cloud" to an on-premise http event collector. Is there a way of doing this?

cheers,
Andy

[woodcock]

You can send S2S (splunk-to-splunk) over any port that you like so what I would do is just use this, but use your preferred port instead of the default of 9997:

https://docs.splunk.com/Documentation/Splunk/6.6.1/Indexer/Forwardmasterdata
I am assuming that when you say "splunk instance" that you mean "splunk indexer" but if you just mean "splunk forwarder" then again, you can do the same thing in outputs.conf but you will also have to do a similar thing in inputs.conf for your receiving Splunk indexers to receive it.

[kochera]

Hi,
we already have a HEC up and running and this is the only service we want to expose.

cheers,
Andy

[esix_splunk · Accepted solution]

If you wanted to send to HEC, you'd basically have to export the search results to file, and then post those to the HEC endpoint.

If you're sending Splunk-2-Splunk, why are you wanting to use HEC? You can add and outputs on one of your "Cloud Instances" that points to your on-premise Splunk, and selectively forward data.. Check out the Routing and Filtering of data : http://docs.splunk.com/Documentation/Splunk/6.6.1/Forwarding/Routeandfilterdatad

[kochera]

Hi,
the reason why we want to use HEC is that we don't want to open additonal tcp ports towards our on-premise Splunk instance.

cheers,
Andy