Getting Data In

How to forward events coming from HTTP event collector to multiple indexers?

lpolo
Motivator

The HTTP event collector is working fine. I need to forward the http events to multiple Splunk indexers.

How should the configs be set up?
Could you provide an example?

Thanks,
Lp

0 Karma

cxj
Engager

I'm looking to setup a VIP for this, but when using port 8089 as the VIP Health Check it keeps showing as down. Has anyone configured a VIP for the HEC?

0 Karma

sjohnson_splunk
Splunk Employee
Splunk Employee

You could be more explicit in describing what you are trying to do.

You could create a DNS alias for all your indexers and forward to the DNS name.

You could also create a VIP using a load-balancer and forward to the VIP.

Finally if you just want the http events balanced among your indexers, you could set up a heavy forwarder, send all the events to it and then have it load balance it's ouput (via outputs.conf) to all indexers.

Pick one.

somesoni2
SplunkTrust
SplunkTrust

My money will be one last option (using HF and Splunk's LB to send data to multiple indexers)

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...