Getting Data In
Highlighted

How to forward events coming from HTTP event collector to multiple indexers?

Motivator

The HTTP event collector is working fine. I need to forward the http events to multiple Splunk indexers.

How should the configs be set up?
Could you provide an example?

Thanks,
Lp

0 Karma
Highlighted

Re: How to forward events coming from HTTP event collector to multiple indexers?

Splunk Employee
Splunk Employee

You could be more explicit in describing what you are trying to do.

You could create a DNS alias for all your indexers and forward to the DNS name.

You could also create a VIP using a load-balancer and forward to the VIP.

Finally if you just want the http events balanced among your indexers, you could set up a heavy forwarder, send all the events to it and then have it load balance it's ouput (via outputs.conf) to all indexers.

Pick one.

Highlighted

Re: How to forward events coming from HTTP event collector to multiple indexers?

SplunkTrust
SplunkTrust

My money will be one last option (using HF and Splunk's LB to send data to multiple indexers)

0 Karma
Highlighted

Re: How to forward events coming from HTTP event collector to multiple indexers?

Engager

I'm looking to setup a VIP for this, but when using port 8089 as the VIP Health Check it keeps showing as down. Has anyone configured a VIP for the HEC?

0 Karma