To understand the challenges that face us with data routing, we will familiarize ourselves with the different network segments that exist within an enterprise network for the life cycle of software. We will use the idealized version of network segmentation, as this gives us the most complete view, though rarely do all of these exist together at an enterprise. There will be a semblance of these network segments at each enterprise, though due to policies and different cultures, these segments can vary in existence, as well as name. The reason why these are important is because each segment is usually protected by a series of firewall rules. Sometimes these rules can bend, sometimes they can break, other times they are immovable objects. These rules pose challenges to getting Splunk data from the forwarders to the indexers.

For those of you unfamiliar with what a network segment is, a network segment is usually an IP address space, a VLAN, or a series of both that all machines...