What is best practice for the HEC endpoint(s) for the "Phantom Remote Search" app in a clustered environment?
Per the instructions in the url below for configuring the "Phantom Remote Search" app in a distributed environment, the HEC endpoint(s) are implied to be indexer server(s).
Our environment uses clustered indexers. Can a heavy forwarder with a HEC endpoint be used to externalize search of a Phantom environment instead of the HEC endpoint(s) being on the indexer(s)?
@jeffrey_berry I suspect you have found the answer by now? However for anyone else looking at this question, YES it is totally plausible to use HFWs as an interim HEC point. I have done this a few times at Splunk Cloud customers as they already had HFW route to the Cloud secured and we just piggy-backed rather than punching another hole out of the network to the cloud indexers.