Deployment Architecture

Universal forwarder on intranet environment

New Member

Hi All,

Our scenario is like, in our AWS environment ,we want to collect our logs by using universal forwarder from our Linux, eks and windows server.

But the thing here is we don't have internet in our environment, can anyone please suggest a solution on how we can install this forwarder and use to forward our logs to centralize server for monitoring?

Basically it's non routable environment

And there are 3 resources from where we want to collect logs,

Linux server

Windows server

Eks cluster 

0 Karma


1. Ther is no such thing as "non-routable" addresses or environment. Every packet can be routed. It can just be your policy that you don't route specific traffic.

2. You must have some form of connectivity between the sources and the destination Splunk installation. Depending on the details of the installation it can be a straight over-the-internet connection, it can be a local connection, it can be a VPN tunnel. But you must have some connectivity. Otherwise how do you want to provide Splunk with the data to index? Send on floppy disks?

0 Karma


Hi @shriramwasule,

if you cannot open a connection with Internet for any system, the only solution is to have a Splunk infrastructure on premise in your segregated network.

If instead you can open the Internet connection only for one system, you could use one Heavy Forwarder (a full Splunk instance that doesn't index data but forward all data to your Private Cloud Splunk Infrastructure) as a concentrator; in this way you can send data to Splunk limiting the Internet connections.

It should be better to use two Heavy Forwarders to balance the load and avoid a Single Point of Failure.



0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...