How to forward events coming from HTTP event collector to multiple indexers?

[lpolo]

The HTTP event collector is working fine. I need to forward the http events to multiple Splunk indexers.

How should the configs be set up?
Could you provide an example?

Thanks,
Lp

[cxj]

I'm looking to setup a VIP for this, but when using port 8089 as the VIP Health Check it keeps showing as down. Has anyone configured a VIP for the HEC?

[sjohnson_splunk]

You could be more explicit in describing what you are trying to do.

You could create a DNS alias for all your indexers and forward to the DNS name.

You could also create a VIP using a load-balancer and forward to the VIP.

Finally if you just want the http events balanced among your indexers, you could set up a heavy forwarder, send all the events to it and then have it load balance it's ouput (via outputs.conf) to all indexers.

Pick one.

[somesoni2]

My money will be one last option (using HF and Splunk's LB to send data to multiple indexers)