Why is Splunk consuming more than 40% of firewall traffic?

[marcor70]

Hello All,

I'm working in a huge installation and Splunk is consuming more than 40% of firewall traffic.
I don't have details of the Splunk Topology yet, but we have firewall between Splunk Servers and Forwarders.
What is the recommendation to minimize the firewall traffic?

I'll appreciate any suggestion.

Thanks in advance,
MarcoR

[richgalloway · Accepted solution]

If you are onboarding a lot of data from your forwarders then that data will, of course, have to pass through the firewalls.

You have some options:
1) Enable SSL on the connections between forwarders and indexers. This will compress the data on those connections.
2) Set compressed = true in your outputs.conf file. SSL compression is better.
3) Re-evaluate the data being onboarded and remove that which is not needed.
4) Use heavy forwarders to filter or edit events before they are sent to the indexers.
5) Remove the firewalls between forwarders and indexers.

[marcor70]

Thanks @richgalloway