Getting Data In

How to enable HTTP Event Collector on indexers?


Hello All,

We wanted to enable HTTP Event Collector (HEC) in our environment. We have one deployment server and four indexer servers set auto load balancing.

1) How to enable HTTP Event Collector on indexers?
2) Can we use two indexers only to enable HEC?
3) How to manage tokens? Can we manage token with respective to individual indexer?

Kindly help me out on this.

Have below link that provides details, but need some clarity on how can we do this?

Thanks in advance!


0 Karma


Docs are here.

It is more recommended to run it on heavy forwarders. You can manage those with deployment server. Depending on if your indexers are clustered managing HEC directly on them is more complicated.

0 Karma


In our environment, we don't have heavy forwarder setup, so we would like to make use of indexers to enable with HEC.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!