Getting Data In

Passive Splunk Forwarder - Splunk Indexer actively querying it

splunk_zen
Builder

Hi.

We have a client that strictly enforces an 'only allowed open ports are listening ones' policy. As in, Splunk Forwarder -> Splunk Server default flow won't work.

Is there any way to configure Splunk Server to actively query the Forwarders if they have new info and thus initiate the data collection process?

Tags (2)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

No there is not. This approach isn't very scalable. However, you could use a different method, such as running scripts on the server to collect the files from the remote machine (without using the forwarder). You could also possibly use NFS or SMB to mount the remote files instead.

View solution in original post

Jason
Motivator

Every forwarder could index locally, and a central search head could query out to all indexers via Distributed Search. This may be a nightmare to manage, as Deployment Server (and License Master in 4.2.x) functions require inbound-to-central-server connections, so configuration and licensing would have to be handled individually or through another process. (Not to mention storage and processing needs on each individual server.)

gkanapathy
Splunk Employee
Splunk Employee

No there is not. This approach isn't very scalable. However, you could use a different method, such as running scripts on the server to collect the files from the remote machine (without using the forwarder). You could also possibly use NFS or SMB to mount the remote files instead.

splunk_zen
Builder

Thanks gk.
I understand the scalability issue, but wouldn't the addition of that choice for a small range of hosts further extend Splunk applications? Some NMS's do this.
How will enterprises with strict security policies like this, get to know Splunk?

What kind of scripts are you suggesting? rsync/scp/sftp transfer?
How would I guarantee transferring only the new bytes in each log?
The cleanness of a Splunk only solution would be preferable.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...