How is performance of HTTP Event Collector ?

[c71996]

How HTTP event Collector is reliable ?

If i use it for collecting application logs . Does it garranty collection of 100% data . It can't miss data alos due tk some error...if this is the case how to to handle?

[nickhills]

It can be made 'reliable' if your client code supports it.

However, if ease of deployment is important to you (or you dont want to implement logic into your HEC client), a universal forwarder with indexer acknowledgement provides a robust level of durability.

See:

Forwarders - https://docs.splunk.com/Documentation/Splunk/8.0.1/Forwarding/Protectagainstlossofin-flightdata
HEC Indexer Ack - https://docs.splunk.com/Documentation/Splunk/8.0.1/Data/AboutHECIDXAck

[nickhills]

You should be aware that there is a tradeoff with IndexerAck, and that is that you can end up with duplicate events where indexerAck has triggered a re-attempt.

[c71996]

So with this i came to conclusion that HEC + ack gives reliable service.

Here is first i send a event data and receive ack num . I query ack tk check the indexing status . If status is positive event is indexed .

If status is negative ...what would be my action item ? I need to wait or resend event ?

[nickhills]

Yes, exactly that.
If you are comfortable building a client to send your logs from your own application etc, then HEC is definitely the way to go.

If you are looking to collect log files created by other applications or 3rd parties, then use a forwarder.

[c71996]

Is forwarder more reliable than HEC ?