Using SSL authentication where the forwarder must present a certficate signed by the appropriate CA is probably the most secure way. You could also configure a firewall or iptables on the Splunk indexer to allow only traffic to the indexer inbound ports from the IP addresses of the known forwarders. That's perhaps a little less overhead to set up. ... View more