Getting Data In

Connectivity issues while onboarding the data

bobba40
New Member

Forwarding data from forwarder to indexer where there is no connectivity . what does this connectivity mean . And to solve that we are planning to use syslog along with Heavy forwarder at each network to index the data to Splunk cloud . Please suggest if its fesable and any one implemenet please help to get the flow.

0 Karma
1 Solution

solarboyz1
Builder

Not really clear on what is meant by "where there is no connectivity . what does this connectivity mean"
If your forwarder cannot connect to your indexers, it will not be able to send events to it.

Let me describe what we have configured, which I believe is similar:

On-prem systems send syslog to the syslog process on an on-prem HF

The syslog process on the HF writes the events log files.
The Splunk process on the HF monitors [monitor:///var/syslog/...] the syslog files
The HF then forwards the data to the indexing tier.
(We also use PCS clustering to provide HA syslog service, since Syslog is not very resilient).

The indexing tier can be in the cloud or on-prem, the heavy forwarders would just need connectivity to the indexers.
You can even send from multiple HFs -> Centralized HFs -> Cloud indexers if you want to reduce the openings to the cloud.

View solution in original post

0 Karma

solarboyz1
Builder

Not really clear on what is meant by "where there is no connectivity . what does this connectivity mean"
If your forwarder cannot connect to your indexers, it will not be able to send events to it.

Let me describe what we have configured, which I believe is similar:

On-prem systems send syslog to the syslog process on an on-prem HF

The syslog process on the HF writes the events log files.
The Splunk process on the HF monitors [monitor:///var/syslog/...] the syslog files
The HF then forwards the data to the indexing tier.
(We also use PCS clustering to provide HA syslog service, since Syslog is not very resilient).

The indexing tier can be in the cloud or on-prem, the heavy forwarders would just need connectivity to the indexers.
You can even send from multiple HFs -> Centralized HFs -> Cloud indexers if you want to reduce the openings to the cloud.

View solution in original post

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.