Dashboards & Visualizations

Load balancing HEC input, Deployment Server and token assignment

_smp_
Builder

I have three Heavy Forwarders managed by a Deployment Server and I want to use it to deliver a package containing an HTTP Event Collector input. I want the incoming HTTP data to be load-balanced to the Heavy Forwarders by a hardware load-balancer. Is it OK to deploy one HEC input with the same token value to three Heavy Forwarders? Are there any risks or technical limitations around doing this, or is this the right way to do it?

0 Karma

manjunathmeti
Champion

If data is sent to the heavy forwarders by a load balancer then you should have same HEC input with the same token value on all Heavy Forwarders. So, It is OK to deploy one HEC input with the same token value to all three Heavy Forwarders.

0 Karma

dkeck
Influencer

Hi,

there are some docs on this topic

http://dev.splunk.com/view/event-collector/SP-CAAAE73 this might help.

0 Karma

dkeck
Influencer

Did it help you? If it was helpfull please accept the answer, thank you

0 Karma

gabrielbico
New Member

This link it is not valid anymore...

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...