What is the best approach to use Data Inputs in a distributed environment (SHC)?

[Omar]

Dear Splunkers, 

We are using Splunk in a distributed environment with an SHC; now, what is the best approach to use Data inputs? 

For example: can I create a TCP or UDP connection in one of the SH? and can I make an HEC input in an SHC environment? is this going to replicate to the remaining SHs? 

Your help is very appreciated.

[gcusello · Accepted solution]

Hi @Omar,

I should'n ur SHC for Data inputs, I'd use one or two dedicated Heavy (or Universal) Forwarders for that role.

If you cannot, I'd prefer to use indexers than SHC for Data Inputs, but Forwarders is a better solution.

Ciao.

Giuseppe

[Omar]

Thank you @gcusello, 

I would go with the HF as a solution, now is creating an HEC or a UDP input in one HF would replicate to the rest of HFs or does it have to be passed manually? 

[gcusello]

Hi @Omar,

Heavy Forwarders are usually managed by the Deployment Server, so you don't need to manage them manually.

You can use your two HFs both for HEC and syslog

In addition, remember to configure at least two HFs, to avoid a Single Point of Failure, adding a Load Balancer in front of them, if you haven't it you can use the Company DNS to create a virtual address to use.

Ciao and happy splunking.

Giuseppe