topic What are the steps to set up HEC on a cluster in Splunk Enterprise

What are the steps to set up HEC on a cluster

robertlynch2020 — Thu, 07 Oct 2021 12:09:27 GMT

I am trying to send data into a cluster with 1 SH, 1MN and 3 indexers.

I am unsure if I

A: Send data to the search head then use the output groups to send the data to the indexers
B: Send the data directly to the indexers (However I don't have a way to load balance this data)

Regards

Robert

Re: What are the steps to set up HEC on a cluster

richgalloway — Thu, 07 Oct 2021 12:29:27 GMT

C. Stand up a heavy forwarder, set up HEC there, and let the HF load-balance to the indexers.

Re: What are the steps to set up HEC on a cluster

PickleRick — Thu, 07 Oct 2021 12:36:27 GMT

As a bit of a further explanation - Search-heads are not normally used for event receiving. Maybe you could use them as forwarders (I'm not sure of that) but that's neither a typical use nor a supported one.

If you set up a HEC input on a single indexer you'd have a highly asymmetrical index distribution. If you set up a HEC input on multiple indexers, you'd need an external load-balancer. And again - distributed inputs are also not a supported setup. You usually supply indexer cluster with data from forwarders (in case of HEC you need Heavy Forwarder).

Re: What are the steps to set up HEC on a cluster

robertlynch2020 — Tue, 12 Oct 2021 14:42:57 GMT

Thanks for your help