Getting Data In
Highlighted

How can we send our firewall logs directly to an indexer (without a heavy forwarder)?

New Member

We have two indexers and 1 search head in our environment.
We are going to integrate a Cisco ASA firewall with Splunk.
Can we send it directly to an indexer instead of a heavy forwarder?

0 Karma
Highlighted

Re: How can we send our firewall logs directly to an indexer (without a heavy forwarder)?

SplunkTrust
SplunkTrust

Yes you can.
open UDP input in the indexer and point the firewall data to the indexer.
read here:
http://docs.splunk.com/Documentation/Splunk/6.6.2/Data/Monitornetworkports
you will probably lose your data load balancing between the 2 indexers capability
but maybe you can configure it to do so on your Cisco ASA firewall
hope it helps

0 Karma
Highlighted

Re: How can we send our firewall logs directly to an indexer (without a heavy forwarder)?

SplunkTrust
SplunkTrust

While I agree with adonio here, you can do this, the question is why would you want to?

By removing the heavy or universal forwarder layer and pointing directly to an indexer you are introducing a single point of failure (ideally you should have a load balancer in front of multiple forwarders if receiving data), and you are going to have an uneven balance of data in the cluster.

Since the balance of data will be uneven then the majority of the searches may end up running on 1 indexer when you query the data...I would not recommend you do this.

If the concern is the parsing occurring on the HF level you could put universal forwarders in front of your indexers instead and just have them to forward the data in a balanced fashion to the indexers...

0 Karma