Getting Data In

How to implement data diode-like forwarding between two distinct Splunk instances?

ngiczi
Engager

Our customer would like to deploy two Splunk instances. The first instance would be in an open network and the another one would be in a highly protected network. No data is allowed to leave the protected network. From the open network, some data flow (on UDP protocol) is allowed to reach the protected network.
The customer would like to forward some interesting events from a Splunk indexer found in the open network to another Splunk indexer found in the protected network. So they would like to implement a data diode-like (unidirectional network) behaviour.

What is the best and safe way to achieve this?

0 Karma
1 Solution

s2_splunk
Splunk Employee
Splunk Employee

Take a look here for the general approach on how to index and forward. The only issue here is if UDP is your only protocol choice, that will not work since the Splunk-2-Splunk link will require TCP.

View solution in original post

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

Take a look here for the general approach on how to index and forward. The only issue here is if UDP is your only protocol choice, that will not work since the Splunk-2-Splunk link will require TCP.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...