Getting Data In

How to forward events coming from HTTP event collector to multiple indexers?

lpolo
Motivator

The HTTP event collector is working fine. I need to forward the http events to multiple Splunk indexers.

How should the configs be set up?
Could you provide an example?

Thanks,
Lp

0 Karma

cxj
Engager

I'm looking to setup a VIP for this, but when using port 8089 as the VIP Health Check it keeps showing as down. Has anyone configured a VIP for the HEC?

0 Karma

sjohnson_splunk
Splunk Employee
Splunk Employee

You could be more explicit in describing what you are trying to do.

You could create a DNS alias for all your indexers and forward to the DNS name.

You could also create a VIP using a load-balancer and forward to the VIP.

Finally if you just want the http events balanced among your indexers, you could set up a heavy forwarder, send all the events to it and then have it load balance it's ouput (via outputs.conf) to all indexers.

Pick one.

somesoni2
Revered Legend

My money will be one last option (using HF and Splunk's LB to send data to multiple indexers)

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...