https://community.splunk.com/t5/Monitoring-Splunk/Number-of-HEC-tokens-on-a-Indexer/m-p/490273#M4070 <P>I think the important consideration is your use case.<BR /> Whilst you don't hint at what the throughput of these is likely to be, I can't help but think there may be a better way to manage your inbound events.</P> <P>As @richgalloway notes, you probably should be running HEC on a heavy forwarder.<BR /> Any performance impact from a large number of tokens (not something I have ever benchmarked) would be constrained to that server - and not the rest of your deployment.</P> <P>That said, if you are expecting a high rate of events (presumably from 500+ sources) you may want to also consider some form of loadbalancing for the HECs.</P> <P>Is each token to be mapped to a different sourcetype?<BR /> If you can add a bit more context (and are happy to do so), you may get some more ideas.</P> Wed, 22 Jan 2020 17:55:24 GMT nickhills 2020-01-22T17:55:24Z https://community.splunk.com/t5/Monitoring-Splunk/Number-of-HEC-tokens-on-a-Indexer/m-p/490271#M4068 <P>Hi there, <BR />We are going to onboard atleast 500 tokens per Index on a single Indexer. IS there any performance penalty of having these many tokens listening on a single machine.</P> Fri, 05 Jun 2020 23:57:07 GMT https://community.splunk.com/t5/Monitoring-Splunk/Number-of-HEC-tokens-on-a-Indexer/m-p/490271#M4068 rashi83 2020-06-05T23:57:07Z https://community.splunk.com/t5/Monitoring-Splunk/Number-of-HEC-tokens-on-a-Indexer/m-p/490272#M4069 <P>If you have multiple indexers, you should be running HEC on a heavy forwarder.</P> Wed, 22 Jan 2020 17:34:58 GMT https://community.splunk.com/t5/Monitoring-Splunk/Number-of-HEC-tokens-on-a-Indexer/m-p/490272#M4069 richgalloway 2020-01-22T17:34:58Z https://community.splunk.com/t5/Monitoring-Splunk/Number-of-HEC-tokens-on-a-Indexer/m-p/490273#M4070 <P>I think the important consideration is your use case.<BR /> Whilst you don't hint at what the throughput of these is likely to be, I can't help but think there may be a better way to manage your inbound events.</P> <P>As @richgalloway notes, you probably should be running HEC on a heavy forwarder.<BR /> Any performance impact from a large number of tokens (not something I have ever benchmarked) would be constrained to that server - and not the rest of your deployment.</P> <P>That said, if you are expecting a high rate of events (presumably from 500+ sources) you may want to also consider some form of loadbalancing for the HECs.</P> <P>Is each token to be mapped to a different sourcetype?<BR /> If you can add a bit more context (and are happy to do so), you may get some more ideas.</P> Wed, 22 Jan 2020 17:55:24 GMT https://community.splunk.com/t5/Monitoring-Splunk/Number-of-HEC-tokens-on-a-Indexer/m-p/490273#M4070 nickhills 2020-01-22T17:55:24Z