Splunk using PAT

[rdownie]

Is it possible to hide multiple forwarders (on separate machines) behind one single PAT address without confusing the indexers? Ideally the Splunk protocol for transferring this data includes something about where it originated from and is not reliant on IP headers.

Since we are popping up lots of little forwarders, using “real” NAT will eat away at our very limited IP address space on the translation subnet. I’m looking for ways to conserve that space and this could be one of them.
Any Ideas?
Thanks,
-Bob

[dwaddle]

This should work fine for simple forwarding data, as the splunk-to-splunk protocol does have the 'real host name' in most data.

I am a little more concerned about things like Deployment Server communication, and would suggest testing that thorougly. Deployment Server could get confused as to who is who - there are settings in deploymentclient.conf like clientName that might help you unconfuse it.

Of course, Splunk 6.1 supports IPv6 - you could do a v6 overlay on top of your IPv4 and have enough address space many times over. And you'd be ahead of the game on IPv6 deployment. It's just a (slightly insane?) thought.