topic Splunk Cloud HEC (http event collector) - Does it run on Splunk Cloud indexers or Splunk Cloud heavy forwarders? in Getting Data In

Splunk Cloud HEC (http event collector) - Does it run on Splunk Cloud indexers or Splunk Cloud heavy forwarders?

bandit — Fri, 17 May 2019 21:02:30 GMT

I'm wanting to know the architecture of the Splunk Cloud version of HEC(http Event Collector) and whether the HEC runs on my Splunk cloud indexers or are there x number of Heavy Forwarders running HEC in Splunk Cloud?

Please note I am NOT asking about the on-premise/Enterprise version of the HEC.

Thanks,

Rob

Re: Splunk Cloud HEC (http event collector) - Does it run on Splunk Cloud indexers or Splunk Cloud heavy forwarders?

amiracle — Sun, 19 May 2019 00:30:02 GMT

In Splunk Cloud the HEC lives on the indexers and has an ELB (Elastic Load Balancer) to spread the data across the indexing tier.

Re: Splunk Cloud HEC (http event collector) - Does it run on Splunk Cloud indexers or Splunk Cloud heavy forwarders?

vegerlandecs — Wed, 25 Sep 2019 08:28:29 GMT

That's great - do you happen to have reference for this? I need to prove with oficial reference that this is how it works 🙂

Re: Splunk Cloud HEC (http event collector) - Does it run on Splunk Cloud indexers or Splunk Cloud heavy forwarders?

amiracle — Wed, 25 Sep 2019 17:55:32 GMT

There will be a reference to this architecture during the .conf19 session that myself and my fellow Splunk Cloud Architect will be delivering. I will forward you a copy of the architecture diagram to your email.

Re: Splunk Cloud HEC (http event collector) - Does it run on Splunk Cloud indexers or Splunk Cloud heavy forwarders?

imhof — Tue, 05 Nov 2019 18:29:12 GMT

Hi Kamilo, I'm searching for that same diagram, are you able to forward at this point? Thanks!