Splunk Enterprise

Splunk Forwarder - Indexer URL's

mweb
New Member

Good afternoon,

I am sure this has been asked many times, but I am just trying to refine what I am looking for.  We currently have our forwarders installed on all desktop machines.  These machines are a combination of, desktops and mobile devices like surfaces etc.

We currently collect information from them, but at the moment the only time they report back to the indexer is when they are on the network.  This normally is ok, but if a machine has been 'offline' for a few days, and we get a few of them, it pushed the ingestion up on that day while it plays catch up.

I was wondering, if we could configure the forwarders to use two indexer URLS, where one can only be used on the network, and the other only used via public internet links etc.  So even if the clients have an internet connection it can still forward the data in (Just not managed via the deployment server)?

I was looking at the doco on an intermediate forwarder, would this be the recommendation?  throw one into a DMZ, have clients talk too it when out in the wild, and then normal when on network.

 

What would the clients output.conf look like? if the intermediate is sitting behind a reverse proxy for instance, how would the SSL/encyption be handled in that case?

Just looking for some options here 🙂 any assistance welcome

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...