topic Re: UF remote to on-prem Splunk Enterprise best practices in Getting Data In

UF remote to on-prem Splunk Enterprise best practices

mikefg — Thu, 29 Jul 2021 16:31:45 GMT

We have several remote and traveling systems that we need to forward logs from to our on-prem Spunk environment. Splunk Cloud is not an option.

Are there any best practices for system config or architecture?

Is it possible to use a reverse proxy for inbound connections to the deployment server?

Should the reverse proxy have a splunk UF or should an intermediate HF be used to forward to the indexer tier?

Re: UF remote to on-prem Splunk Enterprise best practices

richgalloway — Thu, 29 Jul 2021 19:53:03 GMT

Not sure if it's a "best practice", but consider putting 2 or more HFs in a DMZ. The UFs forward to them which forward to the indexers. Use a SSL certificate to keep out unwanted traffic to the HFs.

Re: UF remote to on-prem Splunk Enterprise best practices

mikefg — Fri, 30 Jul 2021 14:33:37 GMT

Thanks. We also have some potential options for collecting logs when connected to our VPN.

Last I looked I don't recall options for local log storage on a UF (only buffer and queue) to be uploaded when connected to a VPN, is this still the case?

Re: UF remote to on-prem Splunk Enterprise best practices

richgalloway — Fri, 30 Jul 2021 14:43:18 GMT

AFAIK, queueing within the UF hasn't changed.