Getting Data In

How to enable HTTP Event Collector on indexers?

bharathkumarnec
Communicator

Hello All,

We wanted to enable HTTP Event Collector (HEC) in our environment. We have one deployment server and four indexer servers set auto load balancing.

1) How to enable HTTP Event Collector on indexers?
2) Can we use two indexers only to enable HEC?
3) How to manage tokens? Can we manage token with respective to individual indexer?

Kindly help me out on this.

Have below link that provides details, but need some clarity on how can we do this?

http://dev.splunk.com/view/event-collector/SP-CAAAE73

Thanks in advance!

Regards,
BK

0 Karma

starcher
SplunkTrust
SplunkTrust

Docs are here. http://docs.splunk.com/Documentation/Splunk/latest/Data/UsetheHTTPEventCollector

It is more recommended to run it on heavy forwarders. You can manage those with deployment server. Depending on if your indexers are clustered managing HEC directly on them is more complicated.

0 Karma

bharathkumarnec
Communicator

In our environment, we don't have heavy forwarder setup, so we would like to make use of indexers to enable with HEC.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!