UF remote to on-prem Splunk Enterprise best practices

[mikefg]

We have several remote and traveling systems that we need to forward logs from to our on-prem Spunk environment. Splunk Cloud is not an option.

Are there any best practices for system config or architecture?

Is it possible to use a reverse proxy for inbound connections to the deployment server?

Should the reverse proxy have a splunk UF or should an intermediate HF be used to forward to the indexer tier?

[richgalloway]

Not sure if it's a "best practice", but consider putting 2 or more HFs in a DMZ.  The UFs forward to them which forward to the indexers.  Use a SSL certificate to keep out unwanted traffic to the HFs.

[mikefg]

Thanks. We also have some potential options for collecting logs when connected to our VPN.

Last I looked I don't recall options for local log storage on a UF (only buffer and queue) to be uploaded when connected to a VPN, is this still the case? 

[richgalloway]

AFAIK, queueing within the UF hasn't changed.