Sending data with HEC vs modular inputs vs raw port

[yvonnec]

I'm trying to figure out the pros and cons of using each of these methods to send data to Splunk. Let's assume I have full control over the data, so I can send it in any format.

To the best of my understanding:
HEC: push data to Spunk via Splunk's REST API
Modular input: a script (?) that runs on the Splunk side, good for pulling data from external REST APIs
Open port: (https://docs.splunk.com/Documentation/Splunk/7.3.0/Data/Monitornetworkports) send arbitrary data over a raw port for Splunk to index, and the indexing can be configured on the Splunk end

What other considerations should I be keeping in mind when deciding between these approaches? Any limitations to be aware of?

Thanks!

[starcher · Accepted solution]

Don't use network ports. you get no load balancing etc. HEC is HTTP post (web hook) meant to be web load balanced. Modular inputs usually you run on a heavy forwarder so you have to plan to have a backup of all inputs etc in case the box dies and you have to rebuild it.

[yvonnec]

Thank you, this is helpful!