We have a distributed on-prem Splunk environment with strict network segmentation between sites. Scenario: Site B: Source machines run Universal Forwarders Logs are sent to a Heavy Forwarder that also acts as a Deployment Server Site A: Indexer Cluster and all management components, including the License Manager (let say zone E) A separate Heavy Forwarder that receives data from Site B (let say zone F) Data flow: UF (Site B) → HF (also act as DS) (Site B) → HF (Site A) → Indexers Constraint: Due to network policy, Site B HF can communicate only with Site A HF. Direct connectivity from Site B to Site A management components (License Manager) is not allowed. Problem: The Site-B Heavy Forwarder (Splunk Enterprise) requires access to the License Manager, but this connectivity is blocked by design. Question: Is there a supported approach to handle HF licensing when direct access to the License Manager is not possible? Has anyone encountered a similar setup and how was it handled? Any guidance or real-world experience would be appreciated. ... View more

Hello, I want to integrate Cloudflare with our Splunk Enterprise via logpull method of Cloudflare. In this method, via rest api I'll pull the logs from Cloudflare every 1 hour.   Can someone please help me, how can I do that? Is there any add-on or app that I can use for calling the rest api? or is there any other methods that I can use? ... View more