Getting Data In

How to implement data diode-like forwarding between two distinct Splunk instances?

Engager

Our customer would like to deploy two Splunk instances. The first instance would be in an open network and the another one would be in a highly protected network. No data is allowed to leave the protected network. From the open network, some data flow (on UDP protocol) is allowed to reach the protected network.
The customer would like to forward some interesting events from a Splunk indexer found in the open network to another Splunk indexer found in the protected network. So they would like to implement a data diode-like (unidirectional network) behaviour.

What is the best and safe way to achieve this?

0 Karma
1 Solution

Splunk Employee
Splunk Employee

Take a look here for the general approach on how to index and forward. The only issue here is if UDP is your only protocol choice, that will not work since the Splunk-2-Splunk link will require TCP.

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

Take a look here for the general approach on how to index and forward. The only issue here is if UDP is your only protocol choice, that will not work since the Splunk-2-Splunk link will require TCP.

View solution in original post

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!