Splunk Enterprise

Splunk Forwarder - Indexer URL's

mweb
New Member

Good afternoon,

I am sure this has been asked many times, but I am just trying to refine what I am looking for.  We currently have our forwarders installed on all desktop machines.  These machines are a combination of, desktops and mobile devices like surfaces etc.

We currently collect information from them, but at the moment the only time they report back to the indexer is when they are on the network.  This normally is ok, but if a machine has been 'offline' for a few days, and we get a few of them, it pushed the ingestion up on that day while it plays catch up.

I was wondering, if we could configure the forwarders to use two indexer URLS, where one can only be used on the network, and the other only used via public internet links etc.  So even if the clients have an internet connection it can still forward the data in (Just not managed via the deployment server)?

I was looking at the doco on an intermediate forwarder, would this be the recommendation?  throw one into a DMZ, have clients talk too it when out in the wild, and then normal when on network.

 

What would the clients output.conf look like? if the intermediate is sitting behind a reverse proxy for instance, how would the SSL/encyption be handled in that case?

Just looking for some options here 🙂 any assistance welcome

Labels (1)
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...