How can we get the Public IP details with Splunk Cloud?

[Splunking18]

Hello,

We are in the process of integrating Splunk with Netcool event management tool.Here we are trying to POST the data to Netcool using webhook.This requires opening on our firewall and for obvious reasons we want to limit this to only the IP's used by Splunk Cloud. Can anyone confirm how can we get the Public IP details, please?

Many thanks!
Kishore

[esix_splunk · Accepted solution]

Easiest and quickest way is to do nslookup of the host you’ll be posting to/from. This is typically your search head, which is https://sh1.yourvanityname.splunkcloud.com.

[Splunking18]

Hi .,
Thanks for the update..

If we allow the static IP in our firewall rules whatever we got using nslookup will remain same or the IP will change frequently?

If its changed then we need to add that particular subnet range to our firewall ?