I have a network with several security zones, each with their own domain, and each with their own Heavy Forwarder. (e.g. Domain XYZ) There are very restrictive firewalls between these zones. All events from all domains end up on my management zone's indexer and accessed by SH on the same management zone. (e.g. domain ABC) Currently, it seems that the "ldapsearch" input cannot be distributed back to each of the Heavy Forwarders on domain XYZ and is only executed on my management domain ABC. According to company policy and network design principles, the management zone splunk instances cannot be allow to perform LDAP queries directly to other domains (XYZ) which are considered more secure. How can I either instruct the Heavy Forwarders on other domains to execute the ldapsearch on my behalf, or perform these searches on schedule for me to get the information into the index? Is it possible to instruct the Heavy Forwarder of domain XYZ to perform the ldapsearch on behalf of the search head in domain ABC?
... View more
I have a layered network with the bulk of the Splunk infrastructure in Zone 1 (Indexer, Collector, Search Head) Within this zone, I'm using split UDP ports to direct specific syslog traffic to appropriate indexes for example: Palo Alto Syslog : Indexer IP: UDP/5140 which ends up in Palo Alto Index Cisco Cisco: Indexer IP: UDP/5141 which ends up in Cisco Index iDRAC / iLO: Indexer IP: UDP/5142 which ends up in iDRAC/iLO index. etc.... In other network zones, Zone 2, 3, 4 etc I have a Heavy Forwarder which allows for devices in these zones to funnel their traffic via the HF to the Indexer (Only communication across firewall between zones are HF to Indexer and no other direct communication from hosts in Zones to Indexer in Zone 1 allowed) Should I configure my HF to also have the same data inputs (ports 5140, 5141, 5142 etc) and also configure devices in these Zones to point to those ports, or should devices in Zones 2,3,4 simply send to UDP 514 and when it reaches the indexer it will be split up appropriately? I'm guessing the data inputs should look the same on all HFs as in the Indexer. Can anyone confirm?
... View more