Hi
I am trying to send data into a cluster with 1 SH, 1MN and 3 indexers.
I am unsure if I
Regards
Robert
C. Stand up a heavy forwarder, set up HEC there, and let the HF load-balance to the indexers.
C. Stand up a heavy forwarder, set up HEC there, and let the HF load-balance to the indexers.
Thanks for your help
As a bit of a further explanation - Search-heads are not normally used for event receiving. Maybe you could use them as forwarders (I'm not sure of that) but that's neither a typical use nor a supported one.
If you set up a HEC input on a single indexer you'd have a highly asymmetrical index distribution. If you set up a HEC input on multiple indexers, you'd need an external load-balancer. And again - distributed inputs are also not a supported setup. You usually supply indexer cluster with data from forwarders (in case of HEC you need Heavy Forwarder).