@immortalraghavan how did you check that the event went to quarantine bucket or to normal hot bucket? If it's by search, the events in the quarantine bucket will still return in search when searching that given log. Only reason it won't be searchable after logging is when the bucket gets frozen based on retention policy (either size based or time based). ... View more

The requirement is to have HEC on a Splunk instance even if it is a HWF and as mentioned, as long as SSL cert is valid then Kinesis firehose can direct to that HWF. Note that to fully use indexer acknowledgements, you might need to turn it on in outputs.conf to ensure end-to-end data delivery with data indexed and replicated in the on-prem indexers., ... View more

If AWS ELB sticky sessions is enabled, subsequent http requests will land to the same indexer. HEC responses includes a cookie that's why. ... View more