https://community.splunk.com/t5/Getting-Data-In/What-is-the-backup-plan-for-Splunk-HTTP-Event-Collector/m-p/464395#M80086 <P>Hi All,</P> <P>Can you please let me know what approach and steps would be in case the Splunk HEC implementation on indexers runs into some issues?</P> <P>This also includes getting syslog data from <CODE>syslog-ng</CODE> servers into indexers using HEC.</P> Sun, 07 Jun 2020 01:41:44 GMT abhi04 2020-06-07T01:41:44Z https://community.splunk.com/t5/Getting-Data-In/What-is-the-backup-plan-for-Splunk-HTTP-Event-Collector/m-p/464395#M80086 <P>Hi All,</P> <P>Can you please let me know what approach and steps would be in case the Splunk HEC implementation on indexers runs into some issues?</P> <P>This also includes getting syslog data from <CODE>syslog-ng</CODE> servers into indexers using HEC.</P> Sun, 07 Jun 2020 01:41:44 GMT https://community.splunk.com/t5/Getting-Data-In/What-is-the-backup-plan-for-Splunk-HTTP-Event-Collector/m-p/464395#M80086 abhi04 2020-06-07T01:41:44Z https://community.splunk.com/t5/Getting-Data-In/What-is-the-backup-plan-for-Splunk-HTTP-Event-Collector/m-p/464396#M80087 <P>You can use useack functionality with HEC if you want.<BR /> See opensourced <A href="https://github.com/chenziliang/splunk-hec-client-cpp">hec client</A><BR /> If all indexers are down or not available, the source should stop sending and either queue or propagate the issue down the chain (ie to stop eating new data).<BR /> For Syslog, Splunk Connect for Syslog has this functionality for example, see disk buffer <A href="https://splunk-connect-for-syslog.readthedocs.io/en/stable/configuration/">here</A></P> Mon, 25 May 2020 21:44:00 GMT https://community.splunk.com/t5/Getting-Data-In/What-is-the-backup-plan-for-Splunk-HTTP-Event-Collector/m-p/464396#M80087 maraman_splunk 2020-05-25T21:44:00Z