topic How to forward data when forwarder cannot contact indexer through firewall? in Getting Data In

How to forward data when forwarder cannot contact indexer through firewall?

joshuapetitt — Thu, 16 Jul 2020 19:37:32 GMT

Hi all,

I have a situation where there are servers from which we wish to get logs into Splunk.

However, we cannot use the traditional Universal Forwarder because these servers are not allowed to connect through the firewall to the indexer.

We can go from "inside" the firewalled network to these servers "outside" the network.

So we could perform some sort of API calls if necessary.

Is there a way to set up a Heavy Forwarder to poll the servers "outside" the network and pull in the logs?

Does the UF support being a "server" instead of a "client", meaning UF would expose an API that could be queried by an HF?

Any and all suggestions (aside from reconfiguring firewall) are welcome, thanks!

Re: How to forward data when forwarder cannot contact indexer through firewall

isoutamo — Thu, 16 Jul 2020 19:07:26 GMT

at least I haven’t heard pull option for core splunk.
One way which come to my mind is e.g. Control-M or any other batch system which can transfer files from A to B etc. But if you are needing real time logs then this isn’t an option.

r. Ismo

Re: How to forward data when forwarder cannot contact indexer through firewall

isoutamo — Sun, 19 Jul 2020 17:44:45 GMT

another opinion could be a SOCKS5 proxy if your organization has it in use. https://docs.splunk.com/Documentation/Forwarder/8.0.5/Forwarder/ConfigureaforwardertouseaSOCKSproxy
r. Ismo