Universal forwarder on intranet environment

[shriramwasule]

Hi All,

Our scenario is like, in our AWS environment ,we want to collect our logs by using universal forwarder from our Linux, eks and windows server.

But the thing here is we don't have internet in our environment, can anyone please suggest a solution on how we can install this forwarder and use to forward our logs to centralize server for monitoring?

Basically it's non routable environment

And there are 3 resources from where we want to collect logs,

Linux server

Windows server

Eks cluster 

[PickleRick]

1. Ther is no such thing as "non-routable" addresses or environment. Every packet can be routed. It can just be your policy that you don't route specific traffic.

2. You must have some form of connectivity between the sources and the destination Splunk installation. Depending on the details of the installation it can be a straight over-the-internet connection, it can be a local connection, it can be a VPN tunnel. But you must have some connectivity. Otherwise how do you want to provide Splunk with the data to index? Send on floppy disks?

[gcusello]

Hi @shriramwasule,

if you cannot open a connection with Internet for any system, the only solution is to have a Splunk infrastructure on premise in your segregated network.

If instead you can open the Internet connection only for one system, you could use one Heavy Forwarder (a full Splunk instance that doesn't index data but forward all data to your Private Cloud Splunk Infrastructure) as a concentrator; in this way you can send data to Splunk limiting the Internet connections.

It should be better to use two Heavy Forwarders to balance the load and avoid a Single Point of Failure.

Ciao.

Giuseppe