topic Re: How to forward events coming from HTTP event collector to multiple indexers? in Getting Data In

How to forward events coming from HTTP event collector to multiple indexers?

lpolo — Mon, 08 Aug 2016 15:46:35 GMT

The HTTP event collector is working fine. I need to forward the http events to multiple Splunk indexers.

How should the configs be set up?
Could you provide an example?

Thanks,
Lp

Re: How to forward events coming from HTTP event collector to multiple indexers?

sjohnson_splunk — Mon, 08 Aug 2016 15:54:14 GMT

You could be more explicit in describing what you are trying to do.

You could create a DNS alias for all your indexers and forward to the DNS name.

You could also create a VIP using a load-balancer and forward to the VIP.

Finally if you just want the http events balanced among your indexers, you could set up a heavy forwarder, send all the events to it and then have it load balance it's ouput (via outputs.conf) to all indexers.

Pick one.

Re: How to forward events coming from HTTP event collector to multiple indexers?

somesoni2 — Mon, 08 Aug 2016 16:11:13 GMT

My money will be one last option (using HF and Splunk's LB to send data to multiple indexers)

Re: How to forward events coming from HTTP event collector to multiple indexers?

cxj — Thu, 13 Jul 2017 13:26:08 GMT

I'm looking to setup a VIP for this, but when using port 8089 as the VIP Health Check it keeps showing as down. Has anyone configured a VIP for the HEC?