Security
Highlighted

Why is Splunk consuming more than 40% of firewall traffic?

New Member

Hello All,

I'm working in a huge installation and Splunk is consuming more than 40% of firewall traffic.
I don't have details of the Splunk Topology yet, but we have firewall between Splunk Servers and Forwarders.
What is the recommendation to minimize the firewall traffic?

I'll appreciate any suggestion.

Thanks in advance,
MarcoR

0 Karma
Highlighted

Re: Why is Splunk consuming more than 40% of firewall traffic?

SplunkTrust
SplunkTrust

If you are onboarding a lot of data from your forwarders then that data will, of course, have to pass through the firewalls.

You have some options:
1) Enable SSL on the connections between forwarders and indexers. This will compress the data on those connections.
2) Set compressed = true in your outputs.conf file. SSL compression is better.
3) Re-evaluate the data being onboarded and remove that which is not needed.
4) Use heavy forwarders to filter or edit events before they are sent to the indexers.
5) Remove the firewalls between forwarders and indexers.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

Highlighted

Re: Why is Splunk consuming more than 40% of firewall traffic?

New Member

Thanks @richgalloway

0 Karma