Getting Data In

How to forward data when forwarder cannot contact indexer through firewall?

joshuapetitt
Path Finder

Hi all,

I have a situation where there are servers from which we wish to get logs into Splunk.

However, we cannot use the traditional Universal Forwarder because these servers are not allowed to connect through the firewall to the indexer.

We can go from "inside" the firewalled network to these servers "outside" the network.

So we could perform some sort of API calls if necessary.

Is there a way to set up a Heavy Forwarder to poll the servers "outside" the network and pull in the logs?

Does the UF support being a "server" instead of a "client", meaning UF would expose an API that could be queried by an HF?

Any and all suggestions (aside from reconfiguring firewall) are welcome, thanks!

Labels (2)
Tags (2)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

at least I haven’t heard pull option for core splunk. 
One way which come to my mind is e.g. Control-M or any other batch system which can transfer files from A to B etc. But if you are needing real time logs then this isn’t an option.

r. Ismo

isoutamo
SplunkTrust
SplunkTrust

Hi

another opinion could be a SOCKS5 proxy if your organization has it in use. https://docs.splunk.com/Documentation/Forwarder/8.0.5/Forwarder/ConfigureaforwardertouseaSOCKSproxy
r. Ismo

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...