Hi folks,
I'm planning on installing some new machines running Splunk instances. Two of the machines are going to run an indexer cluster, one a cluster master and one a search head. The last machine is going to run both a deployment server and a syslog universal forwarder, where syslogs are going to be written to file on the forwarder and forwarded to the indexer cluster. The deployment server is going to deploy apps to the forwarders and (probably) to the one search head.
What I'm wondering is where it would be most logical to put my syslog forwarder/deployment server? Does it make sense to put it in the same subnet as the indexer cluster, cluster master, and search head to keep it nice and simple, or would this possibly make it difficult for apps/configuration to be deployed to forwarders outside the subnet? The alternative would be to make it "external", outside the subnet of the indexer cluster, cluster master, and search head. I'm sorry that I can't give you any details regarding firewalls, domains, etc., mainly because I don't know myself due to the complexity of the system I'm dealing with. I was just hoping someone had any experience with similar cases?
Any input would be much appreciated, thanks!
