Deployment Architecture

HEC and Indexer Clustering

nickmarchini
New Member

The setup we have is as follows

Master x 1
Indexers x 3
Search head x 1

I am trying to enable HEC on the indexers through the inputs.conf and outputs.conf setup as described here
I have setup the local dir and added the inputs.conf and outputs.conf and restarted splunk, but there is still nothing listening on port 8088

I did read this in the documentation

Using HTTP Event Collector in a distributed deployment is incompatible with indexer clustering. Specifically, cluster peers are not supported as deployment clients.
https://docs.splunk.com/Documentation/Splunk/7.1.2/Data/UsetheHTTPEventCollector

Does this mean that I cannot enable HEC even though I am not using the deployment server to push this app out? We are manually editing the .conf files on each indexer.

0 Karma

gjanders
SplunkTrust
SplunkTrust

HEC on the indexers will work fine but you must push your configuration to the indexers via the cluster master as per the indexer cluster architecture
Indexers / search peers should not talk to a deployment server

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...