Join the Conversation
- Find Answers
- :
- Apps & Add-ons
- :
- All Apps and Add-ons
- :
- All Apps and Add-ons
- :
- How is performance of HTTP Event Collector ?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How is performance of HTTP Event Collector ?
How HTTP event Collector is reliable ?
If i use it for collecting application logs . Does it garranty collection of 100% data . It can't miss data alos due tk some error...if this is the case how to to handle?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It can be made 'reliable' if your client code supports it.
However, if ease of deployment is important to you (or you dont want to implement logic into your HEC client), a universal forwarder with indexer acknowledgement provides a robust level of durability.
See:
Forwarders - https://docs.splunk.com/Documentation/Splunk/8.0.1/Forwarding/Protectagainstlossofin-flightdata
HEC Indexer Ack - https://docs.splunk.com/Documentation/Splunk/8.0.1/Data/AboutHECIDXAck
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You should be aware that there is a tradeoff with IndexerAck, and that is that you can end up with duplicate events where indexerAck has triggered a re-attempt.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
So with this i came to conclusion that HEC + ack gives reliable service.
Here is first i send a event data and receive ack num . I query ack tk check the indexing status . If status is positive event is indexed .
If status is negative ...what would be my action item ? I need to wait or resend event ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, exactly that.
If you are comfortable building a client to send your logs from your own application etc, then HEC is definitely the way to go.
If you are looking to collect log files created by other applications or 3rd parties, then use a forwarder.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Is forwarder more reliable than HEC ?
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas
What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)
Automating Threat Operations and Threat Hunting with Recorded Future
