Heavy Forwarder losing data when forwarding data from HTTP Event Collector

[simpkins1958]

We are developing Splunk dashboards. We have a Splunk enterprise server that is receiving HTTP event collector data form our clients. We have setup the server that receives the HEC information as a Heavy Forwarder that indexes locally and then forwards data to several other Splunk servers that we are using for development.

The servers we are forwarding to are losing events.

source=netmotion | stats count

for the same time span is returning significantly different count values. 13,089 from the splunk server receiving the HEC events, and 5,713 from the Splunk server we are forwarding to.

Why is this happening?

[simpkins1958]

We had outputs.conf configured wrong. We were auto load balancing to the three servers.

[lfedak_splunk]

@simpkins1958, did that resolve the issue? If so I will close the question.

[simpkins1958]

Yes. User error...

[gcusello]

Hi simpkins1958,
can you install a Forwarder on the target systems?
If you can, use a Forwarder to ingest and send logs to the Indexer, to be safer about log losing.
Bye.
Giuseppe

[simpkins1958]

We are not getting data from log files. We are getting data from our clients through the Splunk HTTP Event Collector.

[gcusello]

I understand, but if you can have a forwarder on the target server you could take logs from files, so you optimize log transmission and you're safer about log losing.
Otherwise, you should check if there could be a network problem during transmission.
I usually prefer to use Forwarders than HPPT Collector for the abome reasons.
Bye.
Giuseppe