I'm afraid you've misunderstood the question. Each forwarder has only one NIC. The receiver has two NICs, one on a 10/8 network and one on a 172.30/16 network. We don't want to bind the receiving splunkd to only one IP; it must receive from forwarders on both networks. The question is: how do we prevent forwarders (each of which is connected to only one network at a time) from attempting to send data out on both networks simultaneously? (Some forwarders can be manually switched from one network to the other, but they're still only connected to one network at a time.)
... View more