Monitoring Splunk

Number of HEC tokens on a Indexer


Hi there,
We are going to onboard atleast 500 tokens per Index on a single Indexer. IS there any performance penalty of having these many tokens listening on a single machine.

Labels (2)
0 Karma

Ultra Champion

I think the important consideration is your use case.
Whilst you don't hint at what the throughput of these is likely to be, I can't help but think there may be a better way to manage your inbound events.

As @richgalloway notes, you probably should be running HEC on a heavy forwarder.
Any performance impact from a large number of tokens (not something I have ever benchmarked) would be constrained to that server - and not the rest of your deployment.

That said, if you are expecting a high rate of events (presumably from 500+ sources) you may want to also consider some form of loadbalancing for the HECs.

Is each token to be mapped to a different sourcetype?
If you can add a bit more context (and are happy to do so), you may get some more ideas.

If my comment helps, please give it a thumbs up!
0 Karma


If you have multiple indexers, you should be running HEC on a heavy forwarder.

If this reply helps you, an upvote would be appreciated.
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!