Is there a difference between HEC ingestion on-prem vs cloud?

[danielbb]

I'm under the impression that HEC ingestion directly to the indexers is supported natively on cloud. I wonder whether the HEC ingestion on-prem to the indexers is supported in the same way?

[isoutamo]

Hi

I’m not sure how it has done on SCP? Probably it also depends on which experience you have on cloud or not. Maybe some splunkers can open it?

Anyhow you can do it both way in onprem. You can terminate HEC to separate HFs behind of LB or point LB to indexers. Personally I prefer to use separate HFs as that combination disturbs less indexers and searches. You must remember that when you e.g. install new props&transforms.conf to manage HEC inputs this means that those nodes will rebooted!

Here is link to SVA documentation where you can read more https://docs.splunk.com/Documentation/SVA/current/Architectures/About

r. Ismo