What are the steps to set up HEC on a cluster

[robertlynch2020]

Hi 

I am trying to send data into a cluster with 1 SH, 1MN and 3 indexers.

I am unsure if I

• A: Send data to the search head then use the output groups to send the data to the indexers
• B: Send the data directly to the indexers (However I don't have a way to load balance this data)

Regards

Robert

[richgalloway · Accepted solution]

C. Stand up a heavy forwarder, set up HEC there, and let the HF load-balance to the indexers.

[robertlynch2020]

Thanks for your help

[PickleRick]

As a bit of a further explanation - Search-heads are not normally used for event receiving. Maybe you could use them as forwarders (I'm not sure of that) but that's neither a typical use nor a supported one.

If you set up a HEC input on a single indexer you'd have a highly asymmetrical index distribution. If you set up a HEC input on multiple indexers, you'd need an external load-balancer. And again - distributed inputs are also not a supported setup. You usually supply indexer cluster with data from forwarders (in case of HEC you need Heavy Forwarder).