Splunk Cloud HEC (http event collector) - Does it run on Splunk Cloud indexers or Splunk Cloud heavy forwarders?

[bandit]

I'm wanting to know the architecture of the Splunk Cloud version of HEC(http Event Collector) and whether the HEC runs on my Splunk cloud indexers or are there x number of Heavy Forwarders running HEC in Splunk Cloud?

Please note I am NOT asking about the on-premise/Enterprise version of the HEC.

Thanks,

Rob

[amiracle]

In Splunk Cloud the HEC lives on the indexers and has an ELB (Elastic Load Balancer) to spread the data across the indexing tier.

[vegerlandecs]

That's great - do you happen to have reference for this? I need to prove with oficial reference that this is how it works 🙂

[amiracle]

There will be a reference to this architecture during the .conf19 session that myself and my fellow Splunk Cloud Architect will be delivering. I will forward you a copy of the architecture diagram to your email.

[imhof]

Hi Kamilo, I'm searching for that same diagram, are you able to forward at this point? Thanks!