Getting Data In

Splunk using PAT

rdownie
Communicator

Is it possible to hide multiple forwarders (on separate machines) behind one single PAT address without confusing the indexers? Ideally the Splunk protocol for transferring this data includes something about where it originated from and is not reliant on IP headers.

Since we are popping up lots of little forwarders, using “real” NAT will eat away at our very limited IP address space on the translation subnet. I’m looking for ways to conserve that space and this could be one of them.
Any Ideas?
Thanks,
-Bob

dwaddle
SplunkTrust
SplunkTrust

This should work fine for simple forwarding data, as the splunk-to-splunk protocol does have the 'real host name' in most data.

I am a little more concerned about things like Deployment Server communication, and would suggest testing that thorougly. Deployment Server could get confused as to who is who - there are settings in deploymentclient.conf like clientName that might help you unconfuse it.

Of course, Splunk 6.1 supports IPv6 - you could do a v6 overlay on top of your IPv4 and have enough address space many times over. And you'd be ahead of the game on IPv6 deployment. It's just a (slightly insane?) thought.

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...