Deployment Architecture

Has anyone successfully used a Heavy Forwarder to relay Universal Forwarder(s) connectivity to a Deployment Server?

Log_wrangler
Builder

Has anyone successfully used a Heavy Forwarder to relay Universal Forwarder(s) connectivity to a Deployment Server?

The scenario is that the UFs are going to send to the HF, and the DS is needed to configure the UFs.

The UFs can communicate with the HF and the HF can communicate to the DS, but the DS is behind a firewall, so it cannot communicate with the UFs. I know the HF has a FW allow, but I wanted to see if a relay would work.

Please advise.

Thanks

0 Karma
1 Solution

gjanders
SplunkTrust
SplunkTrust

It sounds like your referring to somehow tunneling the connection through which doesn't sound like it will be possible.

However you can have tiered deployment servers, refer to Tiered Deployment Servers, is it possible? and the code example in github

This should help achieve your goal as the HF will become the deployment server of the UF's, it will also be the deployment client of the main deployment server

View solution in original post

gjanders
SplunkTrust
SplunkTrust

It sounds like your referring to somehow tunneling the connection through which doesn't sound like it will be possible.

However you can have tiered deployment servers, refer to Tiered Deployment Servers, is it possible? and the code example in github

This should help achieve your goal as the HF will become the deployment server of the UF's, it will also be the deployment client of the main deployment server

Log_wrangler
Builder

I will accept your answer as it is an option, however not what I was really looking for....

I was interested in the "tunnel" method via HF to DS.

But the HF would have to know how to handle the communication from the UFs so it could reach the DS.

Making the HF a DS as well, might be the only option here.

Thank you

0 Karma

gjanders
SplunkTrust
SplunkTrust

This is the only supported option I believe, you could change your heavy forwarder port from 8089 or have the clients phone home on a new port such as 8090 and attempt to use an OS level tunnel to get them to another host but that would not be a Splunk supported option.

Also note I've never tried an OS tunnel like that (I've used an SSH tunnel but that's about it).

0 Karma
Get Updates on the Splunk Community!

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...