https://community.splunk.com/t5/Getting-Data-In/How-to-Send-Linux-Server-logs-with-an-external-IP-to-splunk/m-p/247722#M47769 <P>You can daisy-chain forwarders. So, your externally-hosted servers can forward to some device in your DMZ, which forwards that on to your indexer. Here are the docs on <A href="http://docs.splunk.com/Documentation/Splunk/6.4.1/Forwarding/Configureanintermediateforwarder">how to configure an intermediate forwarder</A> which will help you configure your intermediate device.</P> <P>In a nutshell, the outside boxes would point to the Intermediate forwarder (which has one interface public and another private with both sides firewalled), then the intermediate forwarder points to your internal Wplunk server. Think of it like a proxy.</P> Sat, 09 Jul 2016 01:18:28 GMT Richfez 2016-07-09T01:18:28Z https://community.splunk.com/t5/Getting-Data-In/How-to-Send-Linux-Server-logs-with-an-external-IP-to-splunk/m-p/247721#M47768 <P>I have a Splunk server which doesn't have an external IP and all my servers with private IP can send their logs through Splunk Universal forwarder to Splunk, but I have couple of servers which are hosted elsewhere and can't talk to the splunk server because it doesn't have an external IP. Is there any way or solution to have my external servers send their logs to my internal Splunk server? I appreciate any suggestion or solution to this issue. </P> <P>Thank you,</P> Sat, 09 Jul 2016 00:48:40 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-Send-Linux-Server-logs-with-an-external-IP-to-splunk/m-p/247721#M47768 naseeb41 2016-07-09T00:48:40Z https://community.splunk.com/t5/Getting-Data-In/How-to-Send-Linux-Server-logs-with-an-external-IP-to-splunk/m-p/247722#M47769 <P>You can daisy-chain forwarders. So, your externally-hosted servers can forward to some device in your DMZ, which forwards that on to your indexer. Here are the docs on <A href="http://docs.splunk.com/Documentation/Splunk/6.4.1/Forwarding/Configureanintermediateforwarder">how to configure an intermediate forwarder</A> which will help you configure your intermediate device.</P> <P>In a nutshell, the outside boxes would point to the Intermediate forwarder (which has one interface public and another private with both sides firewalled), then the intermediate forwarder points to your internal Wplunk server. Think of it like a proxy.</P> Sat, 09 Jul 2016 01:18:28 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-Send-Linux-Server-logs-with-an-external-IP-to-splunk/m-p/247722#M47769 Richfez 2016-07-09T01:18:28Z https://community.splunk.com/t5/Getting-Data-In/How-to-Send-Linux-Server-logs-with-an-external-IP-to-splunk/m-p/247723#M47770 <P>Thank you so much for your help. So, I just installed a universal forwarder on the server which is not in my DMZ and on output.conf I specified the name of the receiving server ( intermediate forwarder) in my DMZ with a public interface. Now where can I see in intermediate forwarder if the logs from other servers were forwarded and how to test the connection between intermediate forwarder and the universal forwarder? Do I have to change any other configurations?</P> <P>I really appreciate your help.</P> Mon, 11 Jul 2016 20:14:03 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-Send-Linux-Server-logs-with-an-external-IP-to-splunk/m-p/247723#M47770 naseeb41 2016-07-11T20:14:03Z