Our customer would like to deploy two Splunk instances. The first instance would be in an open network and the another one would be in a highly protected network. No data is allowed to leave the protected network. From the open network, some data flow (on UDP protocol) is allowed to reach the protected network.
The customer would like to forward some interesting events from a Splunk indexer found in the open network to another Splunk indexer found in the protected network. So they would like to implement a data diode-like (unidirectional network) behaviour.