Q1

mariamms — Sun, 31 Mar 2024 01:46:22 GMT

Explain Splunk Enterprise Event Collector, Processor and Console architecture.

Re: Q1

gcusello — Sun, 31 Mar 2024 08:45:48 GMT

here you can find all the information you need about HEC:

In few words, you have to creare an HEC received creating a token that must be passed to the sender.

You can also have an intermediate Load Balancer for HA features, in this case, you must have the same token in all the receivers.

About Console, what do you mean?

HEC hasn't any console.

If your're speaking of the Cluster consoles, you have to search for Cluster Master (for Indexer Cluster) and SH Deployer (for Search Head Cluster).

At least there's also a Monitorig Console and you can find information at https://docs.splunk.com/Documentation/Splunk/9.2.0/DMC/DMCoverview

Ciao.

Giuseppe

PickleRick — Sun, 31 Mar 2024 13:22:52 GMT

OP is aparently looking for someone to produce an output useable as answer to a question in some course quiz. (Hence Q1).