Good afternoon,
I am sure this has been asked many times, but I am just trying to refine what I am looking for. We currently have our forwarders installed on all desktop machines. These machines are a combination of, desktops and mobile devices like surfaces etc.
We currently collect information from them, but at the moment the only time they report back to the indexer is when they are on the network. This normally is ok, but if a machine has been 'offline' for a few days, and we get a few of them, it pushed the ingestion up on that day while it plays catch up.
I was wondering, if we could configure the forwarders to use two indexer URLS, where one can only be used on the network, and the other only used via public internet links etc. So even if the clients have an internet connection it can still forward the data in (Just not managed via the deployment server)?
I was looking at the doco on an intermediate forwarder, would this be the recommendation? throw one into a DMZ, have clients talk too it when out in the wild, and then normal when on network.
What would the clients output.conf look like? if the intermediate is sitting behind a reverse proxy for instance, how would the SSL/encyption be handled in that case?
Just looking for some options here 🙂 any assistance welcome
