How to enable HTTP Event Collector on indexers?

[bharathkumarnec]

Hello All,

We wanted to enable HTTP Event Collector (HEC) in our environment. We have one deployment server and four indexer servers set auto load balancing.

1) How to enable HTTP Event Collector on indexers?
2) Can we use two indexers only to enable HEC?
3) How to manage tokens? Can we manage token with respective to individual indexer?

Kindly help me out on this.

Have below link that provides details, but need some clarity on how can we do this?

http://dev.splunk.com/view/event-collector/SP-CAAAE73

Thanks in advance!

Regards,
BK

[starcher]

Docs are here. http://docs.splunk.com/Documentation/Splunk/latest/Data/UsetheHTTPEventCollector

It is more recommended to run it on heavy forwarders. You can manage those with deployment server. Depending on if your indexers are clustered managing HEC directly on them is more complicated.

[bharathkumarnec]

In our environment, we don't have heavy forwarder setup, so we would like to make use of indexers to enable with HEC.