How to implement data diode-like forwarding between two distinct Splunk instances?

[ngiczi]

Our customer would like to deploy two Splunk instances. The first instance would be in an open network and the another one would be in a highly protected network. No data is allowed to leave the protected network. From the open network, some data flow (on UDP protocol) is allowed to reach the protected network.
The customer would like to forward some interesting events from a Splunk indexer found in the open network to another Splunk indexer found in the protected network. So they would like to implement a data diode-like (unidirectional network) behaviour.

What is the best and safe way to achieve this?

[s2_splunk · Accepted solution]

Take a look here for the general approach on how to index and forward. The only issue here is if UDP is your only protocol choice, that will not work since the Splunk-2-Splunk link will require TCP.