topic Re: Where do I enable HTTP Event Collector (HEC) and create a new token in an environment with both search head and indexer clustering? in Dashboards & Visualizations

Where do I enable HTTP Event Collector (HEC) and create a new token in an environment with both search head and indexer clustering?

flee — Tue, 09 Aug 2016 17:18:45 GMT

Hello,

We have a Splunk Enterprise environment that has separate tiers that are clustered; Search Heads and Indexers. Where/which tier do I enable HEC on and create tokens? Search Heads or Indexers?

Thank you.

Re: Where do I enable HTTP Event Collector (HEC) and create a new token in an environment with both search head and indexer clustering?

Jeremiah — Tue, 09 Aug 2016 19:23:45 GMT

There are several deployment strategies outlined in the docs:

http://dev.splunk.com/view/event-collector/SP-CAAAE73

If you have a large enough deployment where you have search and indexing tiers, you probably also want to split out the http event collection service onto one or more forwarders.

You can use a single forwarder to receive HEC events and generate keys. That's probably the simplest way to get started.

If you decide to scale out, you can add additional forwarders and use the deployment server to generate keys and automatically distribute them among the forwarders. Use a load balancer to distribute requests among your forwarders.

Re: Where do I enable HTTP Event Collector (HEC) and create a new token in an environment with both search head and indexer clustering?

flee — Tue, 09 Aug 2016 21:54:45 GMT

Thank you Jeremiah! The doc link helps as well.

Re: Where do I enable HTTP Event Collector (HEC) and create a new token in an environment with both search head and indexer clustering?

jmmccollum — Wed, 21 Sep 2016 17:51:04 GMT

What is the best way to manage tokens in a clustered indexer environment where we want to run HEC on the indexers? Can we run a deployment server just for token management while the cluster master manages everything else?

Re: Where do I enable HTTP Event Collector (HEC) and create a new token in an environment with both search head and indexer clustering?

flee — Thu, 22 Sep 2016 03:44:55 GMT

jmmccollum, we haven't started our HEC effort yet. Hopefully, someone else can help answer your questions.

Re: Where do I enable HTTP Event Collector (HEC) and create a new token in an environment with both search head and indexer clustering?

marend_splunk — Mon, 01 Apr 2019 16:40:50 GMT

Hi jmmccollum, these following Splunk answers might help you:
https://answers.splunk.com/answers/685621/hec-and-indexer-clustering.html
https://answers.splunk.com/answers/734827/how-to-deploy-hec-and-token-to-indexers-in-a-clust-1.html