Splunk Cloud HEC and Search API Static IP Allowlisting

Splunk Cloud checks the source IP separately for each protected feature. Use the hec list for HTTP Event Collector traffic on port 443. Use search-api for automated search-head API traffic on port 8089.

A customer-controlled HTTP client can send those HTTPS requests through QuotaGuard without changing its Splunk endpoint, token, credentials, roles, or permissions. Each QuotaGuard subscription supplies two load-balanced static IPv4 addresses. Add both addresses to every Splunk feature list used by that subscription.

Splunk Cloud Gives HEC and Search API Separate Allow Lists

Splunk's current IP allow-list documentation identifies hec and search-api as different features. The hec feature permits approved subnets to send HTTP data to indexers on port 443. The search-api feature controls automated access to the search-head API on port 8089.

The defaults also differ. Splunk documents search-api as closed by default. HEC is open until it is restricted. Adding a subnet to an open feature list changes that feature to allow only the listed sources.

These rules apply across the applicable Splunk tier. A subnet added to search-api can reach the search-head tier. A subnet added to hec can reach HEC across the indexer tier. Splunk authentication and authorization still decide what the approved client can do.

Both QuotaGuard IPs Belong in Every Used Feature List

Splunk accepts CIDR entries. QuotaGuard egress is IPv4, so enter each subscription address as an individual /32. Keep the pair tied to the subscription that carries the Splunk traffic. Each subscription has its own two-address pair.

Splunk Web supports self-service allow-list changes on supported deployments:

1. Open Settings, then Server settings, then IP allow list.
2. Confirm token authentication is enabled and your role has the edit_ip_allow_list capability.
3. Select HEC access for ingestion for HEC traffic or Search head API access for automated API traffic.
4. Add the first QuotaGuard IPv4 address as a /32.
5. Add the second QuotaGuard IPv4 address as a separate /32.
6. Save the change and allow at least 15 minutes for propagation.

Splunk Web requires Splunk Cloud Platform 8.2.2201 or later. It supports the primary search head or search-head cluster, while additional and premium search heads require the Admin Config Service API. FedRAMP High allow-list changes must go through Splunk Support.

If an existing feature list already permits an older source, add and verify both QuotaGuard addresses before removing that source. Splunk won't let you delete the final subnet from a feature list without first restoring the open value.

Python Requests Can Send HEC Through QuotaGuard

Splunk documents HTTPS on port 443 as the default HEC path for normal Splunk Cloud Platform instances. JSON events commonly use /services/collector/event. AWS stacks use an http-inputs- hostname prefix, while GCP and Azure stacks use http-inputs.. Use the exact HEC URL shown for your Splunk deployment.

Install Python Requests:

python -m pip install requests

Store the QuotaGuard connection URL, HEC URL, and HEC token in environment variables. Don't commit these values:

QUOTAGUARDSTATIC_URL="http://username:password@us-east-static-01.quotaguard.com:9293"
SPLUNK_HEC_URL="https://http-inputs-YOUR_STACK.splunkcloud.com/services/collector/event"
SPLUNK_HEC_TOKEN="replace-with-your-hec-token"

The QuotaGuard hostname is region-specific. Select the region closest to the destination when you create the subscription. Changing regions later requires contacting QuotaGuard support.

This example verifies the egress source, then sends one JSON event through the same proxy session:

import os
import requests

proxy_url = os.environ["QUOTAGUARDSTATIC_URL"]

session = requests.Session()
session.proxies.update({
    "http": proxy_url,
    "https": proxy_url,
})

egress_response = session.get(
    "https://ip.quotaguard.com",
    timeout=30,
)
egress_response.raise_for_status()
print("QuotaGuard egress IP:", egress_response.text.strip())

hec_response = session.post(
    os.environ["SPLUNK_HEC_URL"],
    headers={
        "Authorization": f"Splunk {os.environ['SPLUNK_HEC_TOKEN']}"
    },
    json={
        "event": {"message": "QuotaGuard HEC path verification"},
        "sourcetype": "_json",
    },
    timeout=30,
)

print("Splunk HEC status:", hec_response.status_code)
hec_response.raise_for_status()

The egress response must match one of the two IPv4 addresses in the applicable QuotaGuard subscription. The HEC request still needs an active Splunk HEC token and a payload that follows Splunk's event format.

The Egress Check Confirms the Source Before Cutover

You can verify the source path without sending an event to Splunk:

curl --proxy "$QUOTAGUARDSTATIC_URL" https://ip.quotaguard.com

The returned address should match one of the two dashboard IPs. Don't log proxy credentials, HEC tokens, bearer tokens, or event payloads during this check.

After the Splunk change propagates, confirm that the real client can still reach the intended feature. Test the application path through QuotaGuard before removing an older approved source.

Search API Clients Use the Same HTTPS Proxy Pattern

A customer-controlled search API client can use the same session-level HTTP proxy pattern for its HTTPS calls to port 8089. Keep the endpoint, credentials, request body, and permissions already required by Splunk. Add both QuotaGuard addresses to the search-api feature list.

QuotaGuard changes the connection's source IP. It doesn't replace Splunk authentication. An approved source without valid credentials still isn't an authorized API client.

Forwarder s2s Traffic Requires a Separate TCP Path

Universal and heavy forwarders don't use the HEC HTTPS route above. Splunk maps forwarder-to-indexer traffic to the s2s feature on raw TCP port 9997. A Python Requests proxy setting or HEC example does not configure that socket.

A forwarder needs a supported TCP tunnel design for the actual host and runtime. See Splunk Cloud forwarder static IP allowlisting for s2s traffic for the correct deployment boundary. Don't copy the HEC code into a forwarder configuration.

QuotaGuard Static Pricing Starts at $19/Month

QuotaGuard Static direct Starter costs $19 per month and includes 20,000 requests and 10 GB of bandwidth. Starter, Production, and Business use shared static IP pairs. Static Enterprise includes dedicated IPs and proxy resources for $219 per month.

QuotaGuard Shield Pricing Starts at $29/Month

QuotaGuard Shield direct Starter costs $29 per month and includes 20,000 requests and 10 GB of bandwidth. Shield additionally encrypts the customer-to-proxy hop. Neither Static nor Shield decrypts the application's outbound HTTPS payload to Splunk Cloud. Shield Enterprise includes dedicated IPs and proxy resources for $269 per month. QuotaGuard doesn't make a Splunk environment compliant by itself.

See the complete plan table at quotaguard.com/products/pricing. For the architecture and feature-list overview, see the Splunk Cloud static IP integration page.