Can Splunk poll a forwarder

[erick_thompson]

I have a public Universal Forwarder on a public server (public IP). I want to have a Splunk server hosted inside of the local network that consumes the data from the forwarder. I read the forwarder documentation, and didn't see a mention of this scenario. Can Splunk server poll the forwarder?

Thanks,
Erick

[Drainy]

Another but much less secure and ideal option would be to setup the forwarder as an indexer instead.
Once setup as an indexer you can then set your indexer/search head inside the network to perform a distributed search against the indexer in the public domain. The logged data won't make it back into the inside network but it does provide the functionality to "poll" the outside device.

Again, not ideal.

[dwaddle · Accepted solution]

Not as of Splunk 4.2 (and I don't know if this is available in 4.3 or not). As of 4.2 and all prior versions, Splunk expects that the forwarders push data to the indexer. You have some network-layer options like NATs and firewalls ACLs and VPNs and such (even an SSH tunnel) -- but your fowarder is going to have to initiate the connection to the indexer.

[erick_thompson]

Thanks - that does make sense, but I am hoping to avoid messing with VPN or SSH.