Hi,
What's a safe way for a public application to submit REST POST calls to an on-prem splunk enterprise instance?
Ideally I'm looking to do this
- Application makes a REST post call to URL with log entry as payload
- URL resolves to cloud vm
- cloud vm forwards to on-prem instance via VPN
I first thought of using the Universal Forwarded on the cloud vm but HEC is not supported.
Other than running a heavy forwarder on the cloud vm, is there a better way of doing this?
I've considered running my own API on the cloud vm as the forwarder but I'd prefer to go with something that is universally tested and hardened, ie. UF
Thank you
