I have a layered network with the bulk of the Splunk infrastructure in Zone 1 (Indexer, Collector, Search Head)
Within this zone, I'm using split UDP ports to direct specific syslog traffic to appropriate indexes for example:
Palo Alto Syslog : Indexer IP: UDP/5140 which ends up in Palo Alto Index
Cisco Cisco: Indexer IP: UDP/5141 which ends up in Cisco Index
iDRAC / iLO: Indexer IP: UDP/5142 which ends up in iDRAC/iLO index.
etc....
In other network zones, Zone 2, 3, 4 etc I have a Heavy Forwarder which allows for devices in these zones to funnel their traffic via the HF to the Indexer (Only communication across firewall between zones are HF to Indexer and no other direct communication from hosts in Zones to Indexer in Zone 1 allowed)
Should I configure my HF to also have the same data inputs (ports 5140, 5141, 5142 etc) and also configure devices in these Zones to point to those ports, or should devices in Zones 2,3,4 simply send to UDP 514 and when it reaches the indexer it will be split up appropriately?
I'm guessing the data inputs should look the same on all HFs as in the Indexer. Can anyone confirm?
