Where do I enable HTTP Event Collector (HEC) and create a new token in an environment with both search head and indexer clustering?

[flee]

Hello,

We have a Splunk Enterprise environment that has separate tiers that are clustered; Search Heads and Indexers. Where/which tier do I enable HEC on and create tokens? Search Heads or Indexers?

Thank you.

[marend_splunk]

Hi jmmccollum, these following Splunk answers might help you:
https://answers.splunk.com/answers/685621/hec-and-indexer-clustering.html
https://answers.splunk.com/answers/734827/how-to-deploy-hec-and-token-to-indexers-in-a-clust-1.html

[Jeremiah · Accepted solution]

There are several deployment strategies outlined in the docs:

http://dev.splunk.com/view/event-collector/SP-CAAAE73

If you have a large enough deployment where you have search and indexing tiers, you probably also want to split out the http event collection service onto one or more forwarders.

You can use a single forwarder to receive HEC events and generate keys. That's probably the simplest way to get started.

If you decide to scale out, you can add additional forwarders and use the deployment server to generate keys and automatically distribute them among the forwarders. Use a load balancer to distribute requests among your forwarders.

[flee]

jmmccollum, we haven't started our HEC effort yet. Hopefully, someone else can help answer your questions.

[flee]

Thank you Jeremiah! The doc link helps as well.

[jmmccollum]

What is the best way to manage tokens in a clustered indexer environment where we want to run HEC on the indexers? Can we run a deployment server just for token management while the cluster master manages everything else?