The setup we have is as follows
Master x 1
Indexers x 3
Search head x 1
I am trying to enable HEC on the indexers through the inputs.conf and outputs.conf setup as described here
I have setup the local dir and added the inputs.conf and outputs.conf and restarted splunk, but there is still nothing listening on port 8088
I did read this in the documentation
Using HTTP Event Collector in a distributed deployment is incompatible with indexer clustering. Specifically, cluster peers are not supported as deployment clients.
https://docs.splunk.com/Documentation/Splunk/7.1.2/Data/UsetheHTTPEventCollector
Does this mean that I cannot enable HEC even though I am not using the deployment server to push this app out? We are manually editing the .conf files on each indexer.
HEC on the indexers will work fine but you must push your configuration to the indexers via the cluster master as per the indexer cluster architecture
Indexers / search peers should not talk to a deployment server