Getting Data In

HTTP Event Collector in a distributed environment with load balanced Heavy Forwarders

morphis72
Path Finder

I have a pair of heavy forwarders that is load balanced by a round robin DNS record.

I want to set them up as HTTP Event Collectors as described in the documentation:

https://docs.splunk.com/Documentation/Splunk/8.0.2/Data/ScaleHTTPEventCollector

I have enabled the deployment server by setting: useDeploymentServer=1

When I configure my token is now writes to: /opt/splunk/etc/deployment-apps

When the token is created on the deployment server it looks like this:

[http://openshift]
disabled = 0
host = <myDeploymentServerName>
index = kubernetes_test
sourcetype = kubernetes
token = <mytoken>

If I push this out my host= will not match either of the two HF's the config is going to. Do I need to push out a separate config for each HF? Can I manually update the host name? Can I put multiple hosts on that line?

My second question is: I had to manually change the name of index because the HF's aren't part of the index cluster. Will that impact anything?

0 Karma
1 Solution

manjunathmeti
SplunkTrust
SplunkTrust
  • Set it to $decideOnStartup. This will set host to hostname of executing server. This occurs on each splunkd startup.

    host = $decideOnStartup
    
  • If you don't set the host then it'll be <serverIP*>:<port>*, where serverIP server IP where heavy forwarder is installed and port used by HEC for receiving data.

  • If you change the index name then inputs.conf changes should be pushed from deployment server.

View solution in original post

0 Karma

manjunathmeti
SplunkTrust
SplunkTrust
  • Set it to $decideOnStartup. This will set host to hostname of executing server. This occurs on each splunkd startup.

    host = $decideOnStartup
    
  • If you don't set the host then it'll be <serverIP*>:<port>*, where serverIP server IP where heavy forwarder is installed and port used by HEC for receiving data.

  • If you change the index name then inputs.conf changes should be pushed from deployment server.

0 Karma

morphis72
Path Finder

Can any of the fields be updated manually so long as they are pushed back out? Looks like your suggestion of $decideOnStartup is working for me.

But, lets say I wanted to change the [http://openshift] to {http://kubernetes] is that and the other things in the stanza okay to edit so long as the token ID is left the same?

0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

Yes, you can edit and it's parameters keeping token ID same.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...