How can we send wineventlog data to the on-perm cluster and to the cloud?

[danielbb]

We would like to send our wineventlog data to the on-perm cluster as well as to the cloud.

How can we do that? we can fork at the UF level but we are not happy about this approach.

[richgalloway]

Why are you not happy with forking the data in the UF?  That's the recommended method.

You could install an intermediate forwarder and fork the data there, but you should like that approach even less.

[danielbb]

@richgalloway - we can't open up 20000+ servers to the internet

[richgalloway]

You don't have to open the servers to the Internet.  All you have to do is allow them to send to a small number of Splunk Cloud indexers.  All incoming traffic can (and should) be blocked.  Splunk Cloud never initiates a connection to on-prem servers.

Other customers have worked around this issue by using 2 or 3 intermediate forwarders (IFs).  The UFs connect to the on-prem IFs, which are permitted to connect to Splunk Cloud.  It's an extra layer of management and an additional point of failure, but it keeps the network security people happy.

[danielbb]

It seems that we have the following options - 

1) Fork at the UF level

2) Create an intermediate for all the data

3) Create an intermediate just for the data which is routed to the cloud

4) Fork at the indexers level,  but the data is already cooked at this stage

Any ideas?