Getting Data In

Will the HTTP Event Collector respond with any error if it can't keep up with event volume?

sandeep23
Engager

I am planning to use HEC on heavy forwarder(s) which will forward to the indexer(s).

My question: Is HEC designed to return any error(s) to the sender if it can't keep up with volume of input? Does in-memory input queue configuration have any impact on response?

0 Karma
1 Solution

ineeman
Splunk Employee
Splunk Employee

Yes - if we fail to enqueue events into the queues (in memory or persistent) we will give you back an error (and a 502 response code) to say the service is too busy to handle requests.

View solution in original post

ineeman
Splunk Employee
Splunk Employee

Yes - if we fail to enqueue events into the queues (in memory or persistent) we will give you back an error (and a 502 response code) to say the service is too busy to handle requests.

gaarti
New Member

@ineeman
How should we make sure that we don't hit this issue? I keep getting this 503 Server busy error when I have seen a large volume of events getting posted to HEC.

Thanks much!

0 Karma
Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...