Getting Data In

UF remote to on-prem Splunk Enterprise best practices

mikefg
Communicator

We have several remote and traveling systems that we need to forward logs from to our on-prem Spunk environment. Splunk Cloud is not an option.

Are there any best practices for system config or architecture?

Is it possible to use a reverse proxy for inbound connections to the deployment server?

Should the reverse proxy have a splunk UF or should an intermediate HF be used to forward to the indexer tier?

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Not sure if it's a "best practice", but consider putting 2 or more HFs in a DMZ.  The UFs forward to them which forward to the indexers.  Use a SSL certificate to keep out unwanted traffic to the HFs.

---
If this reply helps you, Karma would be appreciated.
0 Karma

mikefg
Communicator

Thanks. We also have some potential options for collecting logs when connected to our VPN.

Last I looked I don't recall options for local log storage on a UF (only buffer and queue) to be uploaded when connected to a VPN, is this still the case? 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

AFAIK, queueing within the UF hasn't changed.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...