Is there a risk of losing log data in HTTP event Collector?

[c71996]

I want to use Splunk for Enterprise level centralized logging.

It collects data from all applications and systems.

Need inputs and approach.

HTTP event Collector is better to collect application logs?

On more load of logs ....does it have the risk of losing log data in HTTP event Collector?

[nickhills]

These are very basic quiestions which would very need detailed responses.

I would start with this guide: https://docs.splunk.com/Documentation/Splunk/8.0.1/Data/Getstartedwithgettingdatain
and: https://docs.splunk.com/Documentation/Splunk/8.0.1/Data/Usingforwardingagents

HTTP event Collector is a high throughput tool, but given the format and context of your question I suggest you start with Universal Forwarders to collect application logs.

[c71996]

Does forwarder creates events based on application log log files incremental way and send events tk splunk ?

[nickhills]

Yes, a forwarder will read application log files (text based, windows event logs, and thousands of others) incrementally, and will create an event in Splunk for each event in the log file.

Each application can be configured to send logs to different sourcetypes allowing you to search, filter or collorate across hosts, applications and event data