All Apps and Add-ons

Will I get duplicate events if I have Multiple Heavy Forwarders (HF) having same inputs set up?

vrmandadi
Builder

We have splunk add-on for aws installed on one of the hf .Can we install the same add-on other HF and create the same inputsso that when one of the hf is down and the other sends data. Is this possible ? or any other work around for this?

Thanks in Advance

0 Karma
1 Solution

nickhills
Ultra Champion

Don't do this.

Yes you would end up with duplicate events.

A better solution is to install multiple HFs with a different selection of inputs on each. (Depending on your AWS footprint, maybe you configure all inputs for a single region on each HF?)

This won't give you fault tolerance if a single HF fails, but it will reduce the amount of disruption as you would still collect data from the surviving HFs.

The AWS TA is a heavyweight app particularly if you collect all AWS data sources for a large number of resources.
Spreading the load across a pool of HFs like this can stop any single HF getting too bogged down.

If my comment helps, please give it a thumbs up!

View solution in original post

nickhills
Ultra Champion

Don't do this.

Yes you would end up with duplicate events.

A better solution is to install multiple HFs with a different selection of inputs on each. (Depending on your AWS footprint, maybe you configure all inputs for a single region on each HF?)

This won't give you fault tolerance if a single HF fails, but it will reduce the amount of disruption as you would still collect data from the surviving HFs.

The AWS TA is a heavyweight app particularly if you collect all AWS data sources for a large number of resources.
Spreading the load across a pool of HFs like this can stop any single HF getting too bogged down.

If my comment helps, please give it a thumbs up!

vrmandadi
Builder

Thank you for your explanation

0 Karma

dindu
Contributor
0 Karma

vrmandadi
Builder

@dindu thank you for your reply .But creating two same inputs on both HF does create duplicate events right?

0 Karma

dindu
Contributor

Hi,

Yes - the Splunk indexer will treat each input as different and index the same data.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...