https://community.splunk.com/t5/Deployment-Architecture/How-to-set-HttpEventCollector-to-work-with-Indexer-Clustering/m-p/255173#M9680 <P>Hi fabiocaldas, for an indexer cluster you'll want to configure http and token stanzas as directed in the inputs.conf doc : <A href="http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf">http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf</A></P> <P>Put this configuration in the cluster master and then apply the cluster bundle to configure all the indexers in the cluster.</P> <P>Basically, this is configuring this input solely through the configuration files, and not the web interface. You could use a standalone indexer as a testbed for getting the config as you want it, then finding it in $SPLUNKHOME/etc/apps/splunk_httpinput as a reference for what you deploy to the cluster.</P> <P>Please let me know how this goes!</P> Thu, 01 Oct 2015 15:45:46 GMT muebel 2015-10-01T15:45:46Z https://community.splunk.com/t5/Deployment-Architecture/How-to-set-HttpEventCollector-to-work-with-Indexer-Clustering/m-p/255172#M9679 <P>HttpEventCollector is an amazing and welcome feature from Splunk 6.3, but there is no documetation explaining how should it be set to work on clustering environment.</P> <P>The <A href="http://docs.splunk.com/Documentation/Splunk/latest/Data/UsetheHTTPEventCollector">documentation</A> only teach how to set it on a single server, but I need to set it on my deployment server and send it to all peers node.</P> <P>Anyone know how to do it?</P> Thu, 01 Oct 2015 15:26:23 GMT https://community.splunk.com/t5/Deployment-Architecture/How-to-set-HttpEventCollector-to-work-with-Indexer-Clustering/m-p/255172#M9679 fabiocaldas 2015-10-01T15:26:23Z https://community.splunk.com/t5/Deployment-Architecture/How-to-set-HttpEventCollector-to-work-with-Indexer-Clustering/m-p/255173#M9680 <P>Hi fabiocaldas, for an indexer cluster you'll want to configure http and token stanzas as directed in the inputs.conf doc : <A href="http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf">http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf</A></P> <P>Put this configuration in the cluster master and then apply the cluster bundle to configure all the indexers in the cluster.</P> <P>Basically, this is configuring this input solely through the configuration files, and not the web interface. You could use a standalone indexer as a testbed for getting the config as you want it, then finding it in $SPLUNKHOME/etc/apps/splunk_httpinput as a reference for what you deploy to the cluster.</P> <P>Please let me know how this goes!</P> Thu, 01 Oct 2015 15:45:46 GMT https://community.splunk.com/t5/Deployment-Architecture/How-to-set-HttpEventCollector-to-work-with-Indexer-Clustering/m-p/255173#M9680 muebel 2015-10-01T15:45:46Z https://community.splunk.com/t5/Deployment-Architecture/How-to-set-HttpEventCollector-to-work-with-Indexer-Clustering/m-p/255174#M9681 <P>Hey muebel, </P> <P>I already tested it by configuration file published by the master and it's works fine. Indeed I asked here to check if there was anyway to use the new web ui to publish it from the master, but ok I can wait for an upgrade in next versions <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Mon, 05 Oct 2015 18:38:31 GMT https://community.splunk.com/t5/Deployment-Architecture/How-to-set-HttpEventCollector-to-work-with-Indexer-Clustering/m-p/255174#M9681 fabiocaldas 2015-10-05T18:38:31Z