topic Re: HTTP Event Collector in a distributed environment with load balanced Heavy Forwarders in Getting Data In

HTTP Event Collector in a distributed environment with load balanced Heavy Forwarders

morphis72 — Thu, 20 Feb 2020 14:43:24 GMT

I have a pair of heavy forwarders that is load balanced by a round robin DNS record.

I want to set them up as HTTP Event Collectors as described in the documentation:

https://docs.splunk.com/Documentation/Splunk/8.0.2/Data/ScaleHTTPEventCollector

I have enabled the deployment server by setting: useDeploymentServer=1

When I configure my token is now writes to: /opt/splunk/etc/deployment-apps

When the token is created on the deployment server it looks like this:

[http://openshift]
disabled = 0
host = <myDeploymentServerName>
index = kubernetes_test
sourcetype = kubernetes
token = <mytoken>

If I push this out my host= will not match either of the two HF's the config is going to. Do I need to push out a separate config for each HF? Can I manually update the host name? Can I put multiple hosts on that line?

My second question is: I had to manually change the name of index because the HF's aren't part of the index cluster. Will that impact anything?

Re: HTTP Event Collector in a distributed environment with load balanced Heavy Forwarders

manjunathmeti — Wed, 30 Sep 2020 04:15:39 GMT

Set it to $decideOnStartup. This will set host to hostname of executing server. This occurs on each splunkd startup.
```
host = $decideOnStartup
```
If you don't set the host then it'll be <serverIP*>:<port>*, where serverIP server IP where heavy forwarder is installed and port used by HEC for receiving data.
If you change the index name then inputs.conf changes should be pushed from deployment server.

Re: HTTP Event Collector in a distributed environment with load balanced Heavy Forwarders

morphis72 — Thu, 20 Feb 2020 15:47:56 GMT

Can any of the fields be updated manually so long as they are pushed back out? Looks like your suggestion of $decideOnStartup is working for me.

But, lets say I wanted to change the [http://openshift] to {http://kubernetes] is that and the other things in the stanza okay to edit so long as the token ID is left the same?

Re: HTTP Event Collector in a distributed environment with load balanced Heavy Forwarders

manjunathmeti — Thu, 20 Feb 2020 16:46:38 GMT

Yes, you can edit and it's parameters keeping token ID same.