Number of HEC tokens on a Indexer

[rashi83]

Hi there,
We are going to onboard atleast 500 tokens per Index on a single Indexer. IS there any performance penalty of having these many tokens listening on a single machine.

[nickhills]

I think the important consideration is your use case.
Whilst you don't hint at what the throughput of these is likely to be, I can't help but think there may be a better way to manage your inbound events.

As @richgalloway notes, you probably should be running HEC on a heavy forwarder.
Any performance impact from a large number of tokens (not something I have ever benchmarked) would be constrained to that server - and not the rest of your deployment.

That said, if you are expecting a high rate of events (presumably from 500+ sources) you may want to also consider some form of loadbalancing for the HECs.

Is each token to be mapped to a different sourcetype?
If you can add a bit more context (and are happy to do so), you may get some more ideas.

[richgalloway]

If you have multiple indexers, you should be running HEC on a heavy forwarder.