Hi Team, We are trying to integrate Oracle Cloud Infrastructure (OCI) logs with our Splunk Enterprise On-Premises environment. Environment: Splunk Enterprise On-Premises Heavy Forwarder (HF) hosted in the internal network HEC is configured on the Heavy Forwarder The HF is not located in the DMZ OCI needs to send logs from the public cloud to our on-premises Splunk environment Issue: Since our Heavy Forwarder is hosted behind the internal firewall and is not exposed to the internet, OCI cannot access our HEC endpoint. Due to our organization's security policy, we cannot expose the HEC endpoint to the public internet or move the Heavy Forwarder to the DMZ. Additionally, we found that the official OCI Splunk Add-on has been archived, so we are looking for an alternative supported solution. We would appreciate guidance on the following: What is the recommended architecture for integrating OCI logs with Splunk On-Premises when HEC cannot be exposed externally? Has anyone implemented this integration in a similar environment where the Splunk infrastructure is completely internal? Are there any best practices or reference architectures for this scenario?
... View more