All Apps and Add-ons

How is performance of HTTP Event Collector ?

New Member

How HTTP event Collector is reliable ?

If i use it for collecting application logs . Does it garranty collection of 100% data . It can't miss data alos due tk some error...if this is the case how to to handle?

0 Karma

Ultra Champion

It can be made 'reliable' if your client code supports it.

However, if ease of deployment is important to you (or you dont want to implement logic into your HEC client), a universal forwarder with indexer acknowledgement provides a robust level of durability.

See:

Forwarders - https://docs.splunk.com/Documentation/Splunk/8.0.1/Forwarding/Protectagainstlossofin-flightdata
HEC Indexer Ack - https://docs.splunk.com/Documentation/Splunk/8.0.1/Data/AboutHECIDXAck

0 Karma

Ultra Champion

You should be aware that there is a tradeoff with IndexerAck, and that is that you can end up with duplicate events where indexerAck has triggered a re-attempt.

0 Karma

New Member

So with this i came to conclusion that HEC + ack gives reliable service.

Here is first i send a event data and receive ack num . I query ack tk check the indexing status . If status is positive event is indexed .

If status is negative ...what would be my action item ? I need to wait or resend event ?

0 Karma

Ultra Champion

Yes, exactly that.
If you are comfortable building a client to send your logs from your own application etc, then HEC is definitely the way to go.

If you are looking to collect log files created by other applications or 3rd parties, then use a forwarder.

0 Karma

New Member

Is forwarder more reliable than HEC ?

0 Karma