Getting Data In

What is the best approach to use Data Inputs in a distributed environment (SHC)?

Omar
Explorer

Dear Splunkers, 

 

We are using Splunk in a distributed environment with an SHC; now, what is the best approach to use Data inputs? 

For example: can I create a TCP or UDP connection in one of the SH? and can I make an HEC input in an SHC environment? is this going to replicate to the remaining SHs? 

 

Your help is very appreciated.

Labels (2)
0 Karma
1 Solution

gcusello
Esteemed Legend

Hi @Omar,

I should'n ur SHC for Data inputs, I'd use one or two dedicated Heavy (or Universal) Forwarders for that role.

If you cannot, I'd prefer to use indexers than SHC for Data Inputs, but Forwarders is a better solution.

Ciao.

Giuseppe

 

View solution in original post

gcusello
Esteemed Legend

Hi @Omar,

I should'n ur SHC for Data inputs, I'd use one or two dedicated Heavy (or Universal) Forwarders for that role.

If you cannot, I'd prefer to use indexers than SHC for Data Inputs, but Forwarders is a better solution.

Ciao.

Giuseppe

 

Omar
Explorer

Thank you @gcusello

 

I would go with the HF as a solution, now is creating an HEC or a UDP input in one HF would replicate to the rest of HFs or does it have to be passed manually? 

0 Karma

gcusello
Esteemed Legend

Hi @Omar,

Heavy Forwarders are usually managed by the Deployment Server, so you don't need to manage them manually.

You can use your two HFs both for HEC and syslog

In addition, remember to configure at least two HFs, to avoid a Single Point of Failure, adding a Load Balancer in front of them, if you haven't it you can use the Company DNS to create a virtual address to use.

Ciao and happy splunking.

Giuseppe

Get Updates on the Splunk Community!

Security Highlights | November 2022 Newsletter

 November 2022 2022 Gartner Magic Quadrant for SIEM: Splunk Named a Leader for the 9th Year in a RowSplunk is ...

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...