How can I send HEC events to a VIP load balancing the indexers?

[abhi04]

HI All,

I have 3 indexers and a VIP load balancing the 3 indexers. I want to send the http and https events using HEC to the VIP so that it load balances between the three indexers and sends it to them. How to do this?
Also, I do not want to send the HEC events to heavy forwarders and then it sends the it to the indexers. I have enabled the HEC directly on indexers. Do I have to create he same tokens across all the three indexers and then while sending it, include the that token and the vip ? Is it how it can be done? Or is there any other way to do so?

[gcusello · Accepted solution]

Hi @abhi04,
did you already seen this urls?
https://www.splunk.com/en_us/blog/tips-and-tricks/configuring-nginx-load-balancer-for-the-http-event...
http://nginx.org/en/docs/http/load_balancing.html#nginx_load_balancing_configuration
Ciao.
Giuseppe

[abhi04]

Thanks @gcusello . This document setups the load balancer but I have the load balancer already setup which sits in front of the indexers. I want to send the events from the source to this load balancer which already jas been detup. Can this load balancer be mentioned while sending the HEC events?

[gcusello]

Hi @abhi04,
I understand that your Load Balancer is already configured, but you can see in the above urls the specifications for configuration so you can check your situation and verify that there isn't any configuration problem.
Anyway, yes, you can use the VIP as destination for the events.

Ciao.
Giuseppe

[abhi04]

@gcusello Is the below command correct to send the events to loadbalancer which will send the events to one of the indexers?

curl -k -u "x:" LoadBalancer_VIP:8088/services/collector -d '{"sourcetype": "mysourcetype", "event":"Hello, World!"}'

[gcusello]

Hi @abhi04,
on Internet there are many exaples to use HEC:
https://www.hurricanelabs.com/splunk-tutorials/how-to-set-up-splunk-hec-the-right-way
https://www.youtube.com/watch?v=9awwyjORWO8
https://www.youtube.com/watch?v=qROXrFGqWAU
Anyway, your example could be correct even if it's different from the example in the first link.

Ciao and Next Time.
Giuseppe