Dashboards & Visualizations

Load balancing HEC input, Deployment Server and token assignment

_smp_
Builder

I have three Heavy Forwarders managed by a Deployment Server and I want to use it to deliver a package containing an HTTP Event Collector input. I want the incoming HTTP data to be load-balanced to the Heavy Forwarders by a hardware load-balancer. Is it OK to deploy one HEC input with the same token value to three Heavy Forwarders? Are there any risks or technical limitations around doing this, or is this the right way to do it?

0 Karma

manjunathmeti
Champion

If data is sent to the heavy forwarders by a load balancer then you should have same HEC input with the same token value on all Heavy Forwarders. So, It is OK to deploy one HEC input with the same token value to all three Heavy Forwarders.

0 Karma

dkeck
Influencer

Hi,

there are some docs on this topic

http://dev.splunk.com/view/event-collector/SP-CAAAE73 this might help.

0 Karma

dkeck
Influencer

Did it help you? If it was helpfull please accept the answer, thank you

0 Karma

gabrielbico
New Member

This link it is not valid anymore...

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...