Hi @bonf_bhai, I guess you would have to use Splunk HTTP Event Collector to receive logs from Firehose. You can find more information about this integration on the following docs: ConfigureFirehose and create-destination-splunk . Also, as expose into the docs, It seems to be possible to send data using a proxy: If you are on a distributed Splunk Enterprise deployment, enter the URL and port of your data receiver node.
For example, if you have an ELB that proxies traffic to your indexers with DNS name example-test-123456789.us-east-1.elb.amazonaws.com and port 443, enter https://example-test-123456789.us-east-1.elb.amazonaws.com:443.
If you want to send data directly to multiple Splunk indexers acting as your data collection nodes, you need a URL that resolves to multiple IP addresses (one for each node) with the port enabled for HTTP event collector on those nodes.
For example, if the hostname that resolves to your indexers is inputs.example-deployment.com, enter https://inputs.example-deployment.com:8088.
... View more