How to forward data when forwarder cannot contact indexer through firewall?

[joshuapetitt]

Hi all,

I have a situation where there are servers from which we wish to get logs into Splunk.

However, we cannot use the traditional Universal Forwarder because these servers are not allowed to connect through the firewall to the indexer.

We can go from "inside" the firewalled network to these servers "outside" the network.

So we could perform some sort of API calls if necessary.

Is there a way to set up a Heavy Forwarder to poll the servers "outside" the network and pull in the logs?

Does the UF support being a "server" instead of a "client", meaning UF would expose an API that could be queried by an HF?

Any and all suggestions (aside from reconfiguring firewall) are welcome, thanks!

[isoutamo]

Hi

at least I haven’t heard pull option for core splunk. 
One way which come to my mind is e.g. Control-M or any other batch system which can transfer files from A to B etc. But if you are needing real time logs then this isn’t an option.

r. Ismo

[isoutamo]

Hi

another opinion could be a SOCKS5 proxy if your organization has it in use. https://docs.splunk.com/Documentation/Forwarder/8.0.5/Forwarder/ConfigureaforwardertouseaSOCKSproxy
r. Ismo