Splunk Enterprise

Forwarder send data to http event collector

kochera
Communicator

Hi,

we would like to forward all data from a splunk instance in the "cloud" to an on-premise http event collector. Is there a way of doing this?

cheers,
Andy

Tags (1)
0 Karma
1 Solution

esix_splunk
Splunk Employee
Splunk Employee

If you wanted to send to HEC, you'd basically have to export the search results to file, and then post those to the HEC endpoint.

If you're sending Splunk-2-Splunk, why are you wanting to use HEC? You can add and outputs on one of your "Cloud Instances" that points to your on-premise Splunk, and selectively forward data.. Check out the Routing and Filtering of data : http://docs.splunk.com/Documentation/Splunk/6.6.1/Forwarding/Routeandfilterdatad

View solution in original post

0 Karma

woodcock
Esteemed Legend

You can send S2S (splunk-to-splunk) over any port that you like so what I would do is just use this, but use your preferred port instead of the default of 9997:

https://docs.splunk.com/Documentation/Splunk/6.6.1/Indexer/Forwardmasterdata
I am assuming that when you say "splunk instance" that you mean "splunk indexer" but if you just mean "splunk forwarder" then again, you can do the same thing in outputs.conf but you will also have to do a similar thing in inputs.conf for your receiving Splunk indexers to receive it.

0 Karma

kochera
Communicator

Hi,
we already have a HEC up and running and this is the only service we want to expose.

cheers,
Andy

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

If you wanted to send to HEC, you'd basically have to export the search results to file, and then post those to the HEC endpoint.

If you're sending Splunk-2-Splunk, why are you wanting to use HEC? You can add and outputs on one of your "Cloud Instances" that points to your on-premise Splunk, and selectively forward data.. Check out the Routing and Filtering of data : http://docs.splunk.com/Documentation/Splunk/6.6.1/Forwarding/Routeandfilterdatad

0 Karma

kochera
Communicator

Hi,
the reason why we want to use HEC is that we don't want to open additonal tcp ports towards our on-premise Splunk instance.

cheers,
Andy

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...