Getting Data In

How to Send Linux Server logs with an external IP to splunk server with no external IP?

naseeb41
New Member

I have a Splunk server which doesn't have an external IP and all my servers with private IP can send their logs through Splunk Universal forwarder to Splunk, but I have couple of servers which are hosted elsewhere and can't talk to the splunk server because it doesn't have an external IP. Is there any way or solution to have my external servers send their logs to my internal Splunk server? I appreciate any suggestion or solution to this issue.

Thank you,

0 Karma

Richfez
SplunkTrust
SplunkTrust

You can daisy-chain forwarders. So, your externally-hosted servers can forward to some device in your DMZ, which forwards that on to your indexer. Here are the docs on how to configure an intermediate forwarder which will help you configure your intermediate device.

In a nutshell, the outside boxes would point to the Intermediate forwarder (which has one interface public and another private with both sides firewalled), then the intermediate forwarder points to your internal Wplunk server. Think of it like a proxy.

0 Karma

naseeb41
New Member

Thank you so much for your help. So, I just installed a universal forwarder on the server which is not in my DMZ and on output.conf I specified the name of the receiving server ( intermediate forwarder) in my DMZ with a public interface. Now where can I see in intermediate forwarder if the logs from other servers were forwarded and how to test the connection between intermediate forwarder and the universal forwarder? Do I have to change any other configurations?

I really appreciate your help.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...