All Apps and Add-ons

How is performance of HTTP Event Collector ?

c71996
Path Finder

How HTTP event Collector is reliable ?

If i use it for collecting application logs . Does it garranty collection of 100% data . It can't miss data alos due tk some error...if this is the case how to to handle?

0 Karma

nickhills
Ultra Champion

It can be made 'reliable' if your client code supports it.

However, if ease of deployment is important to you (or you dont want to implement logic into your HEC client), a universal forwarder with indexer acknowledgement provides a robust level of durability.

See:

Forwarders - https://docs.splunk.com/Documentation/Splunk/8.0.1/Forwarding/Protectagainstlossofin-flightdata
HEC Indexer Ack - https://docs.splunk.com/Documentation/Splunk/8.0.1/Data/AboutHECIDXAck

If my comment helps, please give it a thumbs up!
0 Karma

nickhills
Ultra Champion

You should be aware that there is a tradeoff with IndexerAck, and that is that you can end up with duplicate events where indexerAck has triggered a re-attempt.

If my comment helps, please give it a thumbs up!
0 Karma

c71996
Path Finder

So with this i came to conclusion that HEC + ack gives reliable service.

Here is first i send a event data and receive ack num . I query ack tk check the indexing status . If status is positive event is indexed .

If status is negative ...what would be my action item ? I need to wait or resend event ?

0 Karma

nickhills
Ultra Champion

Yes, exactly that.
If you are comfortable building a client to send your logs from your own application etc, then HEC is definitely the way to go.

If you are looking to collect log files created by other applications or 3rd parties, then use a forwarder.

If my comment helps, please give it a thumbs up!
0 Karma

c71996
Path Finder

Is forwarder more reliable than HEC ?

0 Karma
Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...