Getting Data In

vip and heavy forwarder setup for HEC

antonyhan
Path Finder

Can I use the same HEC token on all HF's which are behind a VIP and set up clients to send data to VIP ip?
The purpose is to keep HF's conf the same and share the load.
Is it a good idea?

Tags (1)
0 Karma
1 Solution

jkat54
SplunkTrust
SplunkTrust

Sure you can.

They might all appear to come from the same host if you don't enable SNAT (source network address translation) on the VIP.

View solution in original post

0 Karma

jkat54
SplunkTrust
SplunkTrust

Sure you can.

They might all appear to come from the same host if you don't enable SNAT (source network address translation) on the VIP.

0 Karma

antonyhan
Path Finder

thanks @jkat54

0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...