Solved: vip and heavy forwarder setup for HEC

antonyhan · ‎05-08-2017

Can I use the same HEC token on all HF's which are behind a VIP and set up clients to send data to VIP ip?
The purpose is to keep HF's conf the same and share the load.
Is it a good idea?

jkat54 · ‎05-08-2017

Sure you can.

They might all appear to come from the same host if you don't enable SNAT (source network address translation) on the VIP.

View solution in original post

jkat54 · ‎05-08-2017

Sure you can.

They might all appear to come from the same host if you don't enable SNAT (source network address translation) on the VIP.

antonyhan · ‎05-09-2017

thanks @jkat54

vip and heavy forwarder setup for HEC

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

All Work and No Play? Not at .conf26! Unwind at These Evening Events

Join the Hackathon at .conf26 and build a No-Code AI agent

Level Up Your Workflow: Mastering Splunk Cloud Management via Terraform

Join the Conversation