topic Re: HTTP Event Collector: Can I set up a farm of Splunk 6.3 forwarders and send them to to 6.1 indexers? in Getting Data In

HTTP Event Collector: Can I set up a farm of Splunk 6.3 forwarders and send them to to 6.1 indexers?

a212830 — Mon, 05 Oct 2015 19:38:33 GMT

Hi,

I have customers interested in using the HTTP event collector, but I'm still running 6.1 indexers and search heads. Can I set up a farm of 6.3 forwarders and send them to 6.1 indexers?

Re: HTTP Event Collector: Can I set up a farm of Splunk 6.3 forwarders and send them to to 6.1 indexers?

sloshburch — Mon, 05 Oct 2015 20:50:49 GMT

http://docs.splunk.com/Documentation/Splunk/latest/Data/UsetheHTTPEventCollector
http://docs.splunk.com/Documentation/Splunk/latest/admin/Inputsconf

I'm not seeing anything that says that the functionality does not exist on [universal] forwarders but haven't tried. I'd say give it a try and see? You can run a curl command against it to see if it catches your http request.

Re: HTTP Event Collector: Can I set up a farm of Splunk 6.3 forwarders and send them to to 6.1 indexers?

gblock_splunk — Tue, 06 Oct 2015 10:00:44 GMT

Yes you can have 6.3 Event Collector instances which forward to 6.2. In the configuration of EC you can select an output group for it to forward to. The receiving indexers do not have to be 6.3.

As to the UF, it is not supported today, though it may work. Only HWF is supported from a forwarder perspective.

Re: HTTP Event Collector: Can I set up a farm of Splunk 6.3 forwarders and send them to to 6.1 indexers?

gblock_splunk — Wed, 04 Nov 2015 02:03:04 GMT

Hi folks

We've just added new documentation on distributed deployment. You can find it here.