topic Re: Sending data with HEC vs modular inputs vs raw port in Getting Data In

Sending data with HEC vs modular inputs vs raw port

yvonnec — Tue, 09 Jul 2019 19:56:11 GMT

I'm trying to figure out the pros and cons of using each of these methods to send data to Splunk. Let's assume I have full control over the data, so I can send it in any format.

To the best of my understanding:
HEC: push data to Spunk via Splunk's REST API
Modular input: a script (?) that runs on the Splunk side, good for pulling data from external REST APIs
Open port: (https://docs.splunk.com/Documentation/Splunk/7.3.0/Data/Monitornetworkports) send arbitrary data over a raw port for Splunk to index, and the indexing can be configured on the Splunk end

What other considerations should I be keeping in mind when deciding between these approaches? Any limitations to be aware of?

Thanks!

Re: Sending data with HEC vs modular inputs vs raw port

starcher — Wed, 10 Jul 2019 13:00:59 GMT

Don't use network ports. you get no load balancing etc. HEC is HTTP post (web hook) meant to be web load balanced. Modular inputs usually you run on a heavy forwarder so you have to plan to have a backup of all inputs etc in case the box dies and you have to rebuild it.

Re: Sending data with HEC vs modular inputs vs raw port

yvonnec — Wed, 10 Jul 2019 14:21:03 GMT

Thank you, this is helpful!