Splunk Enterprise

Splunk Forwarder - Indexer URL's

mweb
New Member

Good afternoon,

I am sure this has been asked many times, but I am just trying to refine what I am looking for.  We currently have our forwarders installed on all desktop machines.  These machines are a combination of, desktops and mobile devices like surfaces etc.

We currently collect information from them, but at the moment the only time they report back to the indexer is when they are on the network.  This normally is ok, but if a machine has been 'offline' for a few days, and we get a few of them, it pushed the ingestion up on that day while it plays catch up.

I was wondering, if we could configure the forwarders to use two indexer URLS, where one can only be used on the network, and the other only used via public internet links etc.  So even if the clients have an internet connection it can still forward the data in (Just not managed via the deployment server)?

I was looking at the doco on an intermediate forwarder, would this be the recommendation?  throw one into a DMZ, have clients talk too it when out in the wild, and then normal when on network.

 

What would the clients output.conf look like? if the intermediate is sitting behind a reverse proxy for instance, how would the SSL/encyption be handled in that case?

Just looking for some options here 🙂 any assistance welcome

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...