Getting Data In

HTTP Event Collector in a distributed environment with load balanced Heavy Forwarders

morphis72
Path Finder

I have a pair of heavy forwarders that is load balanced by a round robin DNS record.

I want to set them up as HTTP Event Collectors as described in the documentation:

https://docs.splunk.com/Documentation/Splunk/8.0.2/Data/ScaleHTTPEventCollector

I have enabled the deployment server by setting: useDeploymentServer=1

When I configure my token is now writes to: /opt/splunk/etc/deployment-apps

When the token is created on the deployment server it looks like this:

[http://openshift]
disabled = 0
host = <myDeploymentServerName>
index = kubernetes_test
sourcetype = kubernetes
token = <mytoken>

If I push this out my host= will not match either of the two HF's the config is going to. Do I need to push out a separate config for each HF? Can I manually update the host name? Can I put multiple hosts on that line?

My second question is: I had to manually change the name of index because the HF's aren't part of the index cluster. Will that impact anything?

0 Karma
1 Solution

manjunathmeti
SplunkTrust
SplunkTrust
  • Set it to $decideOnStartup. This will set host to hostname of executing server. This occurs on each splunkd startup.

    host = $decideOnStartup
    
  • If you don't set the host then it'll be <serverIP*>:<port>*, where serverIP server IP where heavy forwarder is installed and port used by HEC for receiving data.

  • If you change the index name then inputs.conf changes should be pushed from deployment server.

View solution in original post

0 Karma

manjunathmeti
SplunkTrust
SplunkTrust
  • Set it to $decideOnStartup. This will set host to hostname of executing server. This occurs on each splunkd startup.

    host = $decideOnStartup
    
  • If you don't set the host then it'll be <serverIP*>:<port>*, where serverIP server IP where heavy forwarder is installed and port used by HEC for receiving data.

  • If you change the index name then inputs.conf changes should be pushed from deployment server.

0 Karma

morphis72
Path Finder

Can any of the fields be updated manually so long as they are pushed back out? Looks like your suggestion of $decideOnStartup is working for me.

But, lets say I wanted to change the [http://openshift] to {http://kubernetes] is that and the other things in the stanza okay to edit so long as the token ID is left the same?

0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

Yes, you can edit and it's parameters keeping token ID same.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...