topic How to enable HTTP Event Collector on indexers? in Getting Data In

How to enable HTTP Event Collector on indexers?

bharathkumarnec — Mon, 20 Mar 2017 08:59:32 GMT

Hello All,

We wanted to enable HTTP Event Collector (HEC) in our environment. We have one deployment server and four indexer servers set auto load balancing.

1) How to enable HTTP Event Collector on indexers?
2) Can we use two indexers only to enable HEC?
3) How to manage tokens? Can we manage token with respective to individual indexer?

Kindly help me out on this.

Have below link that provides details, but need some clarity on how can we do this?

http://dev.splunk.com/view/event-collector/SP-CAAAE73

Thanks in advance!

Regards,
BK

Re: How to enable HTTP Event Collector on indexers?

starcher — Tue, 21 Mar 2017 03:01:17 GMT

Docs are here. http://docs.splunk.com/Documentation/Splunk/latest/Data/UsetheHTTPEventCollector

It is more recommended to run it on heavy forwarders. You can manage those with deployment server. Depending on if your indexers are clustered managing HEC directly on them is more complicated.

Re: How to enable HTTP Event Collector on indexers?

bharathkumarnec — Tue, 21 Mar 2017 07:11:23 GMT

In our environment, we don't have heavy forwarder setup, so we would like to make use of indexers to enable with HEC.