Getting Data In

What is the backup plan for Splunk HTTP Event Collector implementation if indexers have issues?


Hi All,

Can you please let me know what approach and steps would be in case the Splunk HEC implementation on indexers runs into some issues?

This also includes getting syslog data from syslog-ng servers into indexers using HEC.

Labels (2)
0 Karma

Splunk Employee
Splunk Employee

You can use useack functionality with HEC if you want.
See opensourced hec client
If all indexers are down or not available, the source should stop sending and either queue or propagate the issue down the chain (ie to stop eating new data).
For Syslog, Splunk Connect for Syslog has this functionality for example, see disk buffer here

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...