Splunk Cloud Platform

Network traffic flow integration with Splunk Cloud

camieya2017
New Member

I currently have Splunk Enterprise on prem and want to move to the Cloud. Do we have to have a separate syslog server to collect all network traffic and have forwarders to send them to Splunk cloud instance? What other ways I can send the network traffic flow to Splunk cloud instance?

0 Karma
1 Solution

nickhills
Ultra Champion

Yes - you would want to locate a heavy forwarder/syslog reciver on your local environment to agregate logs, and send them to Splunk Cloud, or install a Universal Forwarder on each host to collect the local syslog.

Commonly, you may do both, and combine with a deployment server to manage all you local UF and HF Splunk components.

If my comment helps, please give it a thumbs up!

View solution in original post

0 Karma

nickhills
Ultra Champion

Yes - you would want to locate a heavy forwarder/syslog reciver on your local environment to agregate logs, and send them to Splunk Cloud, or install a Universal Forwarder on each host to collect the local syslog.

Commonly, you may do both, and combine with a deployment server to manage all you local UF and HF Splunk components.

If my comment helps, please give it a thumbs up!
0 Karma

camieya2017
New Member

Thank you for your answer. We are currently moving out of the data center and migrating to azure environment. Do you have a recommendation where we should have a syslog (deployment) server? internal network or dmz, behind firewall on separate domain? The whole point for moving to Splunk Cloud was to avoid to have splunk enterprise on azure. Any recommendations? Thank you so much in advance.

0 Karma

nickhills
Ultra Champion

If your network segregation is based on zones (and by which, i mean only your DMZ can access the internet) then I would locate your HF inside the DMZ.
I would probably locate the DS on the internal network.

If my comment helps, please give it a thumbs up!
0 Karma
Get Updates on the Splunk Community!

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...

Cisco Use Cases, ITSI Best Practices, and More New Articles from Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Build Your First SPL2 App!

Watch the recording now!.Do you want to SPL™, too? SPL2, Splunk's next-generation data search and preparation ...