Is the HEC a loosely coupled solution?

[ddrillic]

One of our clients wonder which solution is more loosely coupled – the Universal Forwarder or HEC.

I see the decoupling with the Universal Forwarder solution as the writer to the logs and the reader (UF) are completely independent of each other.

However, I'm not sure about the HEC solution.

From Loose coupling

-- In computing and systems design a loosely coupled system is one in which each of its components has, or makes use of, little or no knowledge of the definitions of other separate components. Subareas include the coupling of classes, interfaces, data, and services.1 Loose coupling is the opposite of tight coupling.

[woodcock]

HEC receiving is not supported for receiving on UF (although plenty of people are using it and it appears to be fine); so officially you need a full instance of Splunk which contains all of the pieces that a UF contains so there is no reason to install both. Just install a full instance of splunk.