topic Re: Using HEC vs Heavy Forwarder in Getting Data In

Using HEC vs Heavy Forwarder

anurbhav — Wed, 21 Oct 2020 19:15:09 GMT

Is there a clear list of pros and cons of using HEC vs Heavy forwarders

Also, are there any best practices or preferences of using these 2 options in a given setting

Re: Using HEC vs Heavy Forwarder

richgalloway — Wed, 21 Oct 2020 23:43:40 GMT

There are a lot of things to consider when choosing HF or HEC. There is no documentation on the subject that I know of. It really comes down to what you need to do.

HFs are good for monitoring files or directories and transforming data.

HEC is good for receiving data directly from an application.

Re: Using HEC vs Heavy Forwarder

anurbhav — Wed, 21 Oct 2020 23:48:22 GMT

If i need to ingest my AWS cloudwatch logs to splunk what are the pros and cons of HF vs HEC. What design considerations will it impacts

Re: Using HEC vs Heavy Forwarder

Roy_9 — Thu, 22 Oct 2020 22:27:19 GMT

@anurbhav If you are going with the route of Kinesis-Cloudwatch-HEC-Splunk then i will prefer HEC.

Re: Using HEC vs Heavy Forwarder

arjunpkishore5 — Thu, 22 Oct 2020 22:49:49 GMT

Do you mean HEC vs File monitoring?

HEC can live on your Heavy Forwarder.

With the assumption that you are looking for file monitoring vs HEC, you are looking at pull vs push processes, file monitor keeps monitoring a directory and pulls data when new files or updates to existing files are made. On the other hand, HEC listens on a port and you push data to it. Using one vs the other entirely depends on your use case.

Unfortunately, without more context on what your end goal is, this is all the info I can provide.

Re: Using HEC vs Heavy Forwarder

anurbhav — Thu, 22 Oct 2020 23:04:05 GMT

My end goal is to ingest AWS cloud watch logs to SPLUNK