Getting Data In

Best practices for HEC for on prem Splunk Distributed environment?

abhi04
Path Finder

Hello All,

We have a splunk distributed environment with intermediate heavy forwarder tier and indexer tier.
We need to implement HEC in our current environment which will include how to write to multiple indexes with a single token and ensure some level of resiliency.Please let me know what will be the best approach for this.

0 Karma

lloydknight
Builder

Hi @abhi04

Though I'm not quite sure if there's a best practice on implementing HEC for Distributed deployment, you can apply persistent queues to improve the data input process and potentially prevent data loss.

Please see link below for more information regarding this:
https://docs.splunk.com/Documentation/Splunk/8.0.3/Data/Usepersistentqueues

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!