https://community.splunk.com/t5/Getting-Data-In/uberAgent/m-p/754799#M119795 <P>We looking into uberAgent to be installed on over 17000 endpoints. I'm wanting to know how many HF's would be needed to that many endpoints? Is it volume, number of connections, or both that need to be considered?</P><P>Thank you for any feedback given.</P> Mon, 27 Oct 2025 13:12:04 GMT KenPaul 2025-10-27T13:12:04Z https://community.splunk.com/t5/Getting-Data-In/uberAgent/m-p/754799#M119795 <P>We looking into uberAgent to be installed on over 17000 endpoints. I'm wanting to know how many HF's would be needed to that many endpoints? Is it volume, number of connections, or both that need to be considered?</P><P>Thank you for any feedback given.</P> Mon, 27 Oct 2025 13:12:04 GMT https://community.splunk.com/t5/Getting-Data-In/uberAgent/m-p/754799#M119795 KenPaul 2025-10-27T13:12:04Z https://community.splunk.com/t5/Getting-Data-In/uberAgent/m-p/755488#M119883 <P>From AI -&nbsp;To configure Splunk and uberAgent,&nbsp;first install the Splunk apps on your Splunk server by uploading the files from the uberAgent download. Then, enable the HTTP Event Collector (HEC) in Splunk's global settings to allow uberAgent to send data to it.</P><P>Apparently,&nbsp;the uberAgent works with HEC and then you can send the data stream straight to the indexers, does it make sense?</P> Thu, 13 Nov 2025 21:46:14 GMT https://community.splunk.com/t5/Getting-Data-In/uberAgent/m-p/755488#M119883 ddrillic 2025-11-13T21:46:14Z