Deployment Architecture

HEC and Indexer Clustering

nickmarchini
New Member

The setup we have is as follows

Master x 1
Indexers x 3
Search head x 1

I am trying to enable HEC on the indexers through the inputs.conf and outputs.conf setup as described here
I have setup the local dir and added the inputs.conf and outputs.conf and restarted splunk, but there is still nothing listening on port 8088

I did read this in the documentation

Using HTTP Event Collector in a distributed deployment is incompatible with indexer clustering. Specifically, cluster peers are not supported as deployment clients.
https://docs.splunk.com/Documentation/Splunk/7.1.2/Data/UsetheHTTPEventCollector

Does this mean that I cannot enable HEC even though I am not using the deployment server to push this app out? We are manually editing the .conf files on each indexer.

0 Karma

gjanders
SplunkTrust
SplunkTrust

HEC on the indexers will work fine but you must push your configuration to the indexers via the cluster master as per the indexer cluster architecture
Indexers / search peers should not talk to a deployment server

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...