We have several remote and traveling systems that we need to forward logs from to our on-prem Spunk environment. Splunk Cloud is not an option.
Are there any best practices for system config or architecture?
Is it possible to use a reverse proxy for inbound connections to the deployment server?
Should the reverse proxy have a splunk UF or should an intermediate HF be used to forward to the indexer tier?
Not sure if it's a "best practice", but consider putting 2 or more HFs in a DMZ. The UFs forward to them which forward to the indexers. Use a SSL certificate to keep out unwanted traffic to the HFs.
Thanks. We also have some potential options for collecting logs when connected to our VPN.
Last I looked I don't recall options for local log storage on a UF (only buffer and queue) to be uploaded when connected to a VPN, is this still the case?
AFAIK, queueing within the UF hasn't changed.