Splunk Search

Heavy forwarder with httpout to indexer cluster

j01am
Engager

Hello everyone,

 

Quick question : I need to forward data from HF to Indexer cluster.

Right now, I'm using S2S tcpout function, with useAck, default loadbalancing and maxQueueSize

I study the possibility to use the httpout instead of tcpout, due to traffic filtering.

 

The documentation seems a bit light about httpout, is it possible to use Indexer loadbalancer, ack, and maxQueueSize function?

Thanks for your help!

 

Jonas

Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust
Hi
What issue you are trying to solve with this change?
I think that usually it’s better to use S2S between splunk nodes than http version.
r. Ismo
0 Karma

j01am
Engager

Hello @isoutamo 

Thanks a lot for your feedback

I need to study the httpout because Splunk nodes communicate though customer network, with firewalls, so it's easier to open a proxy compatible traffic than a tcp/9997 for example.

So, is there any possibility to use Indexer loadbalancer, ack, and maxQueueSize functions in httpout ?

A saw that httpout is a relative new functionnality, since 8.x, maybe these functionality will be in the roadmap?

 

Thanks

Jonas

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Disclaimer - I haven't used httpout much so I might be mistaken here.

But.

httpout is not a HEC output (although it needs an HEC input and valid HEC token; it's complicated). It's s2s protocol embedded in http transport. It is indeed a fairly recent invention mostly aimed at situations like yours - where it's easier (politically, not technically) to allow outgoing http traffic (even if it's only pseudo-http) than some unknown protocol.

Having said that I'd expect most of the functionalities normally working with tcpout (like useACK) to work.

I'd test it first in the lab before pushing to prod anyway.

0 Karma

j01am
Engager

Current documentation is very light regarding httpout, hope it will be improved in next versions

0 Karma

PickleRick
SplunkTrust
SplunkTrust

That's true. Remember that docs pages have feedback form on the bottom. You can use it to... provide feedback. And yes, this feedback (of course if precise and reasonable, not just "I don't like this page" ;-)) is read and the docs pages do get better in time because of that.

0 Karma

j01am
Engager

Anyone have inputs about that?

0 Karma
Get Updates on the Splunk Community!

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...