Load balancing HEC input, Deployment Server and token assignment

[_smp_]

I have three Heavy Forwarders managed by a Deployment Server and I want to use it to deliver a package containing an HTTP Event Collector input. I want the incoming HTTP data to be load-balanced to the Heavy Forwarders by a hardware load-balancer. Is it OK to deploy one HEC input with the same token value to three Heavy Forwarders? Are there any risks or technical limitations around doing this, or is this the right way to do it?

[manjunathmeti]

If data is sent to the heavy forwarders by a load balancer then you should have same HEC input with the same token value on all Heavy Forwarders. So, It is OK to deploy one HEC input with the same token value to all three Heavy Forwarders.

[dkeck]

Hi,

there are some docs on this topic

http://dev.splunk.com/view/event-collector/SP-CAAAE73 this might help.

[tomasmoser]

Correct link
https://dev.splunk.com/view/event-collector/SP-CAAAE6M

which redirects to

https://dev.splunk.com/enterprise/docs/devtools/httpeventcollector/

[dkeck]

Did it help you? If it was helpfull please accept the answer, thank you

[gabrielbico]

This link it is not valid anymore...