We wanted to enable HTTP Event Collector (HEC) in our environment. We have one deployment server and four indexer servers set auto load balancing.
1) How to enable HTTP Event Collector on indexers?
2) Can we use two indexers only to enable HEC?
3) How to manage tokens? Can we manage token with respective to individual indexer?
Kindly help me out on this.
Have below link that provides details, but need some clarity on how can we do this?
Thanks in advance!
Docs are here. http://docs.splunk.com/Documentation/Splunk/latest/Data/UsetheHTTPEventCollector
It is more recommended to run it on heavy forwarders. You can manage those with deployment server. Depending on if your indexers are clustered managing HEC directly on them is more complicated.
In our environment, we don't have heavy forwarder setup, so we would like to make use of indexers to enable with HEC.