Deployment Architecture

HEC and Indexer Clustering

New Member

The setup we have is as follows

Master x 1
Indexers x 3
Search head x 1

I am trying to enable HEC on the indexers through the inputs.conf and outputs.conf setup as described here
I have setup the local dir and added the inputs.conf and outputs.conf and restarted splunk, but there is still nothing listening on port 8088

I did read this in the documentation

Using HTTP Event Collector in a distributed deployment is incompatible with indexer clustering. Specifically, cluster peers are not supported as deployment clients.
https://docs.splunk.com/Documentation/Splunk/7.1.2/Data/UsetheHTTPEventCollector

Does this mean that I cannot enable HEC even though I am not using the deployment server to push this app out? We are manually editing the .conf files on each indexer.

0 Karma

SplunkTrust
SplunkTrust

HEC on the indexers will work fine but you must push your configuration to the indexers via the cluster master as per the indexer cluster architecture
Indexers / search peers should not talk to a deployment server

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes and swag!