https://community.splunk.com/t5/Getting-Data-In/Best-practices-for-HEC-for-on-prem-Splunk-Distributed/m-p/463980#M80013 <P>Hello All,</P> <P>We have a splunk distributed environment with intermediate heavy forwarder tier and indexer tier.<BR /> We need to implement HEC in our current environment which will include how to write to multiple indexes with a single token and ensure some level of resiliency.Please let me know what will be the best approach for this.</P> Fri, 22 May 2020 18:04:44 GMT abhi04 2020-05-22T18:04:44Z https://community.splunk.com/t5/Getting-Data-In/Best-practices-for-HEC-for-on-prem-Splunk-Distributed/m-p/463980#M80013 <P>Hello All,</P> <P>We have a splunk distributed environment with intermediate heavy forwarder tier and indexer tier.<BR /> We need to implement HEC in our current environment which will include how to write to multiple indexes with a single token and ensure some level of resiliency.Please let me know what will be the best approach for this.</P> Fri, 22 May 2020 18:04:44 GMT https://community.splunk.com/t5/Getting-Data-In/Best-practices-for-HEC-for-on-prem-Splunk-Distributed/m-p/463980#M80013 abhi04 2020-05-22T18:04:44Z https://community.splunk.com/t5/Getting-Data-In/Best-practices-for-HEC-for-on-prem-Splunk-Distributed/m-p/463981#M80014 <P>Hi @abhi04</P> <P>Though I'm not quite sure if there's a best practice on implementing HEC for Distributed deployment, you can apply persistent queues to improve the data input process and potentially prevent data loss.</P> <P>Please see link below for more information regarding this:<BR /> <A href="https://docs.splunk.com/Documentation/Splunk/8.0.3/Data/Usepersistentqueues">https://docs.splunk.com/Documentation/Splunk/8.0.3/Data/Usepersistentqueues</A></P> Fri, 22 May 2020 18:18:20 GMT https://community.splunk.com/t5/Getting-Data-In/Best-practices-for-HEC-for-on-prem-Splunk-Distributed/m-p/463981#M80014 lloydknight 2020-05-22T18:18:20Z