Deployment Architecture

HEC and Indexer Clustering

nickmarchini
New Member

The setup we have is as follows

Master x 1
Indexers x 3
Search head x 1

I am trying to enable HEC on the indexers through the inputs.conf and outputs.conf setup as described here
I have setup the local dir and added the inputs.conf and outputs.conf and restarted splunk, but there is still nothing listening on port 8088

I did read this in the documentation

Using HTTP Event Collector in a distributed deployment is incompatible with indexer clustering. Specifically, cluster peers are not supported as deployment clients.
https://docs.splunk.com/Documentation/Splunk/7.1.2/Data/UsetheHTTPEventCollector

Does this mean that I cannot enable HEC even though I am not using the deployment server to push this app out? We are manually editing the .conf files on each indexer.

0 Karma

gjanders
SplunkTrust
SplunkTrust

HEC on the indexers will work fine but you must push your configuration to the indexers via the cluster master as per the indexer cluster architecture
Indexers / search peers should not talk to a deployment server

0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

 Prepare to elevate your security operations with the powerful upgrade to Splunk Enterprise Security 8.x! This ...

Get Early Access to AI Playbook Authoring: Apply for the Alpha Private Preview ...

Passionate about security automation? Apply now to our AI Playbook Authoring Alpha private preview ...

Reduce and Transform Your Firewall Data with Splunk Data Management

Managing high-volume firewall data has always been a challenge. Noisy events and verbose traffic logs often ...