Splunk Enterprise

Splunk Forwarder - Indexer URL's

New Member

Good afternoon,

I am sure this has been asked many times, but I am just trying to refine what I am looking for.  We currently have our forwarders installed on all desktop machines.  These machines are a combination of, desktops and mobile devices like surfaces etc.

We currently collect information from them, but at the moment the only time they report back to the indexer is when they are on the network.  This normally is ok, but if a machine has been 'offline' for a few days, and we get a few of them, it pushed the ingestion up on that day while it plays catch up.

I was wondering, if we could configure the forwarders to use two indexer URLS, where one can only be used on the network, and the other only used via public internet links etc.  So even if the clients have an internet connection it can still forward the data in (Just not managed via the deployment server)?

I was looking at the doco on an intermediate forwarder, would this be the recommendation?  throw one into a DMZ, have clients talk too it when out in the wild, and then normal when on network.


What would the clients output.conf look like? if the intermediate is sitting behind a reverse proxy for instance, how would the SSL/encyption be handled in that case?

Just looking for some options here 🙂 any assistance welcome

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...