Dashboards & Visualizations

Setting UP HEC in Indexer cluster and how to connect HEC to search head ?

naveenyadav99
Explorer

Hello,

We are in indexer cluster,2indexer,1clustermaster,deployment server & License master,2 HEC and 1 search head. I have created tokens in one of my HEC instance and i can able to see logs are coming into HEC1 but we need it on SH and also same token should be reflect on Another HEC2.

Note: Two HEC are added as deployment client to DS.

Please help me on this .

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @naveenyadav99,

the flow is the following:

  • HEC source systems send their data to the Load Balancer address,
  • the Load Balancer send the received data to the HFs containing the token for HEC,
  • HF receive data and send them to Indexers,
  • Indexers index received data and makes them available for Search Heads,
  • Search Heads use these data for searches.

Ciao.

Giuseppe

View solution in original post

0 Karma

naveenyadav99
Explorer

yes we do have load balancer 

so we need to cofigure load balancer to HF so that it will push logs to Indexer and we can able to serach in SH

that's what you are trying to explain me. Correct me if i am wrong 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @naveenyadav99,

the flow is the following:

  • HEC source systems send their data to the Load Balancer address,
  • the Load Balancer send the received data to the HFs containing the token for HEC,
  • HF receive data and send them to Indexers,
  • Indexers index received data and makes them available for Search Heads,
  • Search Heads use these data for searches.

Ciao.

Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @naveenyadav99,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

gcusello
SplunkTrust
SplunkTrust

Hi @naveenyadav99,

when you say HEC, are you meaning of the source or of the receiver?

if the source, you have to define who are the receivers; they should be always two to avoid Single Points of Failure and have a Load Balancer (or a DNS configuration) to manage load balancing and fail over.

if they the receivers, they should be Heavy Forwarders, this means that you don't need of nothing else: only the teo HFs to receive the HEC data flow and forwardr it to the Indexers.

In other words, you need only two HFs to receid HEC Data Flows and send them to Indexers, you don't need tokens and to enable HEC receiving on search Heads or Indexers.

Token must be the same in both the HFs.

Ciao.

Giuseppe

 

 

0 Karma
Get Updates on the Splunk Community!

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...