Getting Data In

Where should I put my syslog universal forwarder/deployment server with regards to subnets and firewalls in an indexer clustering environment?

Builder

Hi folks,

I'm planning on installing some new machines running Splunk instances. Two of the machines are going to run an indexer cluster, one a cluster master and one a search head. The last machine is going to run both a deployment server and a syslog universal forwarder, where syslogs are going to be written to file on the forwarder and forwarded to the indexer cluster. The deployment server is going to deploy apps to the forwarders and (probably) to the one search head.

What I'm wondering is where it would be most logical to put my syslog forwarder/deployment server? Does it make sense to put it in the same subnet as the indexer cluster, cluster master, and search head to keep it nice and simple, or would this possibly make it difficult for apps/configuration to be deployed to forwarders outside the subnet? The alternative would be to make it "external", outside the subnet of the indexer cluster, cluster master, and search head. I'm sorry that I can't give you any details regarding firewalls, domains, etc., mainly because I don't know myself due to the complexity of the system I'm dealing with. I was just hoping someone had any experience with similar cases?

Any input would be much appreciated, thanks!

0 Karma
1 Solution

Splunk Employee
Splunk Employee

As long as your deployment clients have connectivity to your deployment server's mangement port. I do not see any additional benefit by placing the deployment client in the same subnet as your indexer cluster.

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

As long as your deployment clients have connectivity to your deployment server's mangement port. I do not see any additional benefit by placing the deployment client in the same subnet as your indexer cluster.

View solution in original post

0 Karma