we'd prefer to have the option of forwarder from cloud to enterprise, but it seems this can only be done enterprise forwarder to cloud, and not the other way around, so it looks like using a hybrid model instead may be the only option. This sounds like the data would remain in the cloud, but able to search from enterprise - is there any info on how to implement this? (links to hybrid info) - not come across hybrid model, and information is a little light (http://docs.splunk.com/Documentation/SplunkCloud/latest/User/Overview - its mentioned in the first paragraph, but no supplementary documentation etc) - I assume that may be because its fairly straightforward to setup a hybrid env? - has anyone setup and used a hybrid model? thanks in advance, ... View more