Getting Data In

How to fix my HTTP event collector connectivity?

Communicator

Hi All,

We are facing issues with receiving data through HTTP event collector. Below is our scenario:

source server ip : 10.1.2.234
destination server ip (search head local ip) : 10.1.2.233
search head url: www.xyz.net
search head vip : 10.1.2.232
port : 8088

Now from source IP to which IP do we need to request for connectivity to port 8088??

Thanks in advance!

Regards,
BK

0 Karma

Influencer

HEC listens on your indexer (or forwarders). I don't see either listed, but that's where you need connectivity.

SplunkTrust
SplunkTrust

Agreed you don't setup HEC receivers on search heads. You typically setup a HF or group of them behind a load balancer. And those HFs send to your indexers.

0 Karma

Communicator

Yes Understood! So we have two indexers in our environment and no heavy forwarder setup.

So we need to enable HEC on those two indexers and generate individual tokens on each indexer and use both of them to send data through http??

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!