uberAgent

[KenPaul]

We looking into uberAgent to be installed on over 17000 endpoints. I'm wanting to know how many HF's would be needed to that many endpoints? Is it volume, number of connections, or both that need to be considered?

Thank you for any feedback given.

[ddrillic]

From AI - To configure Splunk and uberAgent, first install the Splunk apps on your Splunk server by uploading the files from the uberAgent download. Then, enable the HTTP Event Collector (HEC) in Splunk's global settings to allow uberAgent to send data to it.

Apparently, the uberAgent works with HEC and then you can send the data stream straight to the indexers, does it make sense?