Splunk-based aggregation tier?

[woodcock]

Client desires a physical aggregation point on the way into Azure where the real indexers will be. I guess this is for splitting some data to different clusters. Nothing needs to be written or searchable there so no disk IO concerns but gobs of port I/O. What Splunk configuration would you use for this? I am assuming Indexer, built like the main indexer tier but with no special disk concerns, but I have never done anything like this so I am unsure. What would/did you do?

[jconger]

One or more intermediate forwarders would do the trick. Here is some documentation (it is for Splunk Cloud, but the concept is the same) -> http://docs.splunk.com/Documentation/SplunkCloud/latest/Forwarding/Configureanintermediateforwarder

Does this client have an existing Splunk environment on-premises and moving indexing to Azure? If so, how are they sending data to the indexer(s) today - universal forwarder, TCP, UDP, HTTP, something else? These methods are still viable with the indexing tier in Azure as long as the network connectivity is there. Perhaps the client wants to set some network rules to only allow inbound to the indexers in Azure from certain machines?

[adonio]

are you asking for an Intermediate Forwarder or Heavy Forwarder machine specs?