I have a question about moving an HTTP Event Collector (HEC) integration from a Splunk demo setup to a production setup. Right now, I am using a demo Splunk environment where HEC is enabled on port 8088. My application sends events to a URL similar to: https://demo-host:8088/services/collector For the production Splunk environment, I was told that no separate port (like 8088) is required because HEC will be exposed through HTTPS, possibly behind a load balancer or proxy. My questions are: When switching from the demo environment to the production environment, does the Splunk instance URL typically change? If the URL changes, what impact does this have on the existing integration? Do I only need to update the hostname and port? Will the HEC token also change? Any SSL or network/firewall considerations? Is there anything specific to keep in mind when migrating a HEC integration from demo to production? Background: Demo setup uses HEC on port 8088 Production setup will expose HEC without a custom port (likely on HTTPS 443) I want to understand how this difference affects the application endpoint configuration
... View more
