Splunk

QuotaGuard puts two fixed egress IPs onto your Splunk Cloud IP allow list at the connectivity layer, so your forwarder or HEC client passes the source-IP check without changing where you host. Trusted by developer and platform teams securing log and telemetry pipelines at production scale since 2013.

Splunk Cloud allowlists inbound data by source IP, and the list is per feature. The hec, s2s, and search-api features each have their own allow list, managed through the ACS API or the IP allow list management page in Splunk Web. Many lists default open at 0.0.0.0/0, so ingest works until you lock one down. Cloud platforms like Render, Railway, Heroku, Fly.io, and AWS Lambda rotate outbound IPs on every deploy and restart, so the entry breaks the next time your app moves and Splunk starts rejecting the data.

• Two-Minute Setup: Add your QuotaGuard connection URL as the QUOTAGUARDSTATIC_URL environment variable in your app or forwarder host. Configure your HTTP client to proxy outbound traffic to your Splunk Cloud stack. Add your two static IPs to the correct feature allow list through the ACS API or Splunk Web.
• Per-Feature Allow Lists Covered: Splunk scopes allow lists by feature type. Add the two QuotaGuard IPs to hec for the HTTP Event Collector, s2s for forwarder-to-indexer traffic, and search-api or search-ui for search. ACS allow lists accept IPv4 and IPv6 CIDR, up to 200 subnets per feature.
• Compliance-Stack Ready: On PCI and HIPAA compliance stacks, the search-api and search-ui allow lists are closed by default, so a stable egress IP is required to connect. On FedRAMP High, allow list changes go through Splunk Support, which makes a rarely-changing IP more valuable.
• Multi-Platform Support: Works whether you host on Heroku, Render, Railway, Fly.io, AWS Lambda, Vercel, Netlify Functions, Kubernetes, or direct VPS. The same QuotaGuard configuration applies; set the env var in your hosting platform's settings.
• Production-Grade Reliability: A load-balanced pair of static IPs with automated failover. Ingest stays consistent through deploys, restarts, and infrastructure migrations. Both IPs go on the Splunk side, and traffic routes through whichever responds first.
• Shield for Regulated Log Data: For SOC 2, PCI-DSS, or HIPAA-bound logs that carry PHI, cardholder data, or other regulated PII, QuotaGuard Shield uses SSL passthrough so QuotaGuard never decrypts the data moving between your app and Splunk Cloud.

Default-open note: Many Splunk Cloud feature allow lists ship open at 0.0.0.0/0, so ingest works before you restrict anything. The static IP requirement starts the moment you tighten a list to real subnets, or when you land on a PCI, HIPAA, or FedRAMP stack where search features are closed or self-service is removed. Add the two QuotaGuard IPs before you lock down, and the ingest path keeps passing.