topic Splunk HEC using distributed deployment in Deployment Architecture

Splunk HEC using distributed deployment

SirHill17 — Wed, 24 Apr 2019 14:13:41 GMT

Hello,

I am aiming to enable HEC on my current indexers (in cluster) and I would like to use a deployment-server to manage the tokens.

I already have a deployment-server for the Universal forwarders configuration.

Can someone please help confirming that I can leverage the same deployment-server for both UF and HEC ?

Thanks for your help.

Cyril

Re: Splunk HEC using distributed deployment

harsmarvania57 — Wed, 24 Apr 2019 14:30:46 GMT

Instead of Deployment Server, I'll prefer Cluster Master to handle HEC configuration and tokens on all Splunk Indexers in Cluster (As far as I remember only pain point is when you'll push bundle from CM to Indexers for new HEC token(s), it will restart Splunk process on Indexers)

Have a look at https://docs.splunk.com/Documentation/Splunk/7.2.6/Data/ScaleHTTPEventCollector#Place_and_distribute_the_HEC_on_indexer_cluster_peer_nodes

Re: Splunk HEC using distributed deployment

SirHill17 — Fri, 26 Apr 2019 12:27:31 GMT

Thanks for your inputs. I didn't think about this solution. The point about restart Splunk process is the same with Deployment-Server. But it makes more sense now to me to leverage the Cluster Manager than the Deployment-Server used for UF.