Getting Data In

How can I send HEC events to a VIP load balancing the indexers?

abhi04
Path Finder

HI All,

I have 3 indexers and a VIP load balancing the 3 indexers. I want to send the http and https events using HEC to the VIP so that it load balances between the three indexers and sends it to them. How to do this?
Also, I do not want to send the HEC events to heavy forwarders and then it sends the it to the indexers. I have enabled the HEC directly on indexers. Do I have to create he same tokens across all the three indexers and then while sending it, include the that token and the vip ? Is it how it can be done? Or is there any other way to do so?

Labels (2)
0 Karma
1 Solution

abhi04
Path Finder

Thanks @gcusello . This document setups the load balancer but I have the load balancer already setup which sits in front of the indexers. I want to send the events from the source to this load balancer which already jas been detup. Can this load balancer be mentioned while sending the HEC events?

0 Karma

gcusello
Legend

Hi @abhi04,
I understand that your Load Balancer is already configured, but you can see in the above urls the specifications for configuration so you can check your situation and verify that there isn't any configuration problem.
Anyway, yes, you can use the VIP as destination for the events.

Ciao.
Giuseppe

0 Karma

abhi04
Path Finder

@gcusello Is the below command correct to send the events to loadbalancer which will send the events to one of the indexers?

curl -k -u "x:" LoadBalancer_VIP:8088/services/collector -d '{"sourcetype": "mysourcetype", "event":"Hello, World!"}'

0 Karma

gcusello
Legend

Hi @abhi04,
on Internet there are many exaples to use HEC:
https://www.hurricanelabs.com/splunk-tutorials/how-to-set-up-splunk-hec-the-right-way
https://www.youtube.com/watch?v=9awwyjORWO8
https://www.youtube.com/watch?v=qROXrFGqWAU
Anyway, your example could be correct even if it's different from the example in the first link.

Ciao and Next Time.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...