topic Re: Load balancing HEC input, Deployment Server and token assignment in Dashboards & Visualizations

Load balancing HEC input, Deployment Server and token assignment

_smp_ — Wed, 16 Jan 2019 15:03:00 GMT

I have three Heavy Forwarders managed by a Deployment Server and I want to use it to deliver a package containing an HTTP Event Collector input. I want the incoming HTTP data to be load-balanced to the Heavy Forwarders by a hardware load-balancer. Is it OK to deploy one HEC input with the same token value to three Heavy Forwarders? Are there any risks or technical limitations around doing this, or is this the right way to do it?

Re: Load balancing HEC input, Deployment Server and token assignment

dkeck — Wed, 16 Jan 2019 15:10:40 GMT

Hi,

there are some docs on this topic

http://dev.splunk.com/view/event-collector/SP-CAAAE73 this might help.

Re: Load balancing HEC input, Deployment Server and token assignment

dkeck — Thu, 17 Jan 2019 06:47:41 GMT

Did it help you? If it was helpfull please accept the answer, thank you

Re: Load balancing HEC input, Deployment Server and token assignment

gabrielbico — Wed, 19 Feb 2020 00:30:46 GMT

This link it is not valid anymore...

Re: Load balancing HEC input, Deployment Server and token assignment

manjunathmeti — Wed, 19 Feb 2020 04:20:12 GMT

If data is sent to the heavy forwarders by a load balancer then you should have same HEC input with the same token value on all Heavy Forwarders. So, It is OK to deploy one HEC input with the same token value to all three Heavy Forwarders.

Re: Load balancing HEC input, Deployment Server and token assignment

tomasmoser — Sat, 19 Sep 2020 20:16:29 GMT

Correct link
https://dev.splunk.com/view/event-collector/SP-CAAAE6M

which redirects to

https://dev.splunk.com/enterprise/docs/devtools/httpeventcollector/