The setup we have is as follows
Master x 1
Indexers x 3
Search head x 1
I am trying to enable HEC on the indexers through the inputs.conf and outputs.conf setup as described here
I have setup the local dir and added the inputs.conf and outputs.conf and restarted splunk, but there is still nothing listening on port 8088
I did read this in the documentation
Using HTTP Event Collector in a distributed deployment is incompatible with indexer clustering. Specifically, cluster peers are not supported as deployment clients.
https://docs.splunk.com/Documentation/Splunk/7.1.2/Data/UsetheHTTPEventCollector
Does this mean that I cannot enable HEC even though I am not using the deployment server to push this app out? We are manually editing the .conf files on each indexer.
... View more