Setting UP HEC in Indexer cluster and how to connect HEC to search head ?

[naveenyadav99]

Hello,

We are in indexer cluster,2indexer,1clustermaster,deployment server & License master,2 HEC and 1 search head. I have created tokens in one of my HEC instance and i can able to see logs are coming into HEC1 but we need it on SH and also same token should be reflect on Another HEC2.

Note: Two HEC are added as deployment client to DS.

Please help me on this .

[naveenyadav99]

yes we do have load balancer 

so we need to cofigure load balancer to HF so that it will push logs to Indexer and we can able to serach in SH

that's what you are trying to explain me. Correct me if i am wrong 

[gcusello · Accepted solution]

Hi @naveenyadav99,

the flow is the following:

• HEC source systems send their data to the Load Balancer address,
• the Load Balancer send the received data to the HFs containing the token for HEC,
• HF receive data and send them to Indexers,
• Indexers index received data and makes them available for Search Heads,
• Search Heads use these data for searches.

Ciao.

Giuseppe

[gcusello]

Hi @naveenyadav99,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

[gcusello]

Hi @naveenyadav99,

when you say HEC, are you meaning of the source or of the receiver?

if the source, you have to define who are the receivers; they should be always two to avoid Single Points of Failure and have a Load Balancer (or a DNS configuration) to manage load balancing and fail over.

if they the receivers, they should be Heavy Forwarders, this means that you don't need of nothing else: only the teo HFs to receive the HEC data flow and forwardr it to the Indexers.

In other words, you need only two HFs to receid HEC Data Flows and send them to Indexers, you don't need tokens and to enable HEC receiving on search Heads or Indexers.

Token must be the same in both the HFs.

Ciao.

Giuseppe