Getting Data In

HowTo pull logs into trusted network from a forwarder located in DMZ

tjensen
Explorer

Hello,
I search a way to get realtime logs from DMZ-Zone into a Trusted Network, where the Indexer is located.
A Forwarder located in DMZ collects all logs, but this Forwarder can only send (push) logs to the trusted network. Is there a way to change the direction of the communication to pull these logs from the Forwarder?

I can pull all Logfiles directly from the log-source, but this is not in realtime.

Any suggestions on this ?

Thanks,
Torsten

Tags (4)
0 Karma
1 Solution

bmacias84
Champion

What you are trying to accomplish does not exist in Splunk nativly, but there is always a method. You could use rsync with following switches --stats -rltgoDzrv --append-verify to copy the data to Trusted Network Forward and setup a Monitor on that directory.


rsync --stats -rltgoDzrv --append-verify -e "ssh -l ssh-user" rsync:://targethost2/module/src/ /tmp/secure_data/

Or Possibly a scripted input using ssh and tail.

View solution in original post

bmacias84
Champion

What you are trying to accomplish does not exist in Splunk nativly, but there is always a method. You could use rsync with following switches --stats -rltgoDzrv --append-verify to copy the data to Trusted Network Forward and setup a Monitor on that directory.


rsync --stats -rltgoDzrv --append-verify -e "ssh -l ssh-user" rsync:://targethost2/module/src/ /tmp/secure_data/

Or Possibly a scripted input using ssh and tail.

vial8
Engager

Definately the best way to go. I use this on our solution where we have logs that is on a vendor system.

0 Karma

tjensen
Explorer

Thanks for this feedback. We'll try it like this way.

0 Karma

lrhazi
Path Finder

I dont know if Splunk indexer-forwarder supports the feature you need, but a workaround might be to to use something like stunnel or OpenSSH, to create a tunnel that is "listening" on the forwarder, and "forwarding" to the indexer. Your forwarder would then be configured to forward to localhost:port.

With SSH this would be called reverse tunnel and would be something like:

  • On the indexer: ssh -R 6514:localhost:6514 username@forwarder

Now on the forwarder, if you connect to localhost:6514, you would be connected to the indexer:6514

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...