Getting Data In

How can I send HEC events to a VIP load balancing the indexers?

abhi04
Communicator

HI All,

I have 3 indexers and a VIP load balancing the 3 indexers. I want to send the http and https events using HEC to the VIP so that it load balances between the three indexers and sends it to them. How to do this?
Also, I do not want to send the HEC events to heavy forwarders and then it sends the it to the indexers. I have enabled the HEC directly on indexers. Do I have to create he same tokens across all the three indexers and then while sending it, include the that token and the vip ? Is it how it can be done? Or is there any other way to do so?

Labels (2)
0 Karma
1 Solution

abhi04
Communicator

Thanks @gcusello . This document setups the load balancer but I have the load balancer already setup which sits in front of the indexers. I want to send the events from the source to this load balancer which already jas been detup. Can this load balancer be mentioned while sending the HEC events?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @abhi04,
I understand that your Load Balancer is already configured, but you can see in the above urls the specifications for configuration so you can check your situation and verify that there isn't any configuration problem.
Anyway, yes, you can use the VIP as destination for the events.

Ciao.
Giuseppe

0 Karma

abhi04
Communicator

@gcusello Is the below command correct to send the events to loadbalancer which will send the events to one of the indexers?

curl -k -u "x:" LoadBalancer_VIP:8088/services/collector -d '{"sourcetype": "mysourcetype", "event":"Hello, World!"}'

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @abhi04,
on Internet there are many exaples to use HEC:
https://www.hurricanelabs.com/splunk-tutorials/how-to-set-up-splunk-hec-the-right-way
https://www.youtube.com/watch?v=9awwyjORWO8
https://www.youtube.com/watch?v=qROXrFGqWAU
Anyway, your example could be correct even if it's different from the example in the first link.

Ciao and Next Time.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...