An http event collector (hec) is essentially a heavy forwarder with the special hec listener. You would use the same sort of outputs.conf that you would use on any search head or heavy forwarder to route logs to your downstream indexers. Example outputs.conf config: # BASE SETTINGS # TURN OFF INDEXING ON SEARCH HEAD OR HEAVY FORWARDER [indexAndForward] index = false [tcpout] # FORWARD ALL INTERNAL LOGS forwardedindex.0.whitelist = .* forwardedindex.1.blacklist = forwardedindex.2.whitelist = # round robin to all indexers defaultGroup = all_indexers [tcpout:all_indexers] server = host500.acme.com:9997,host501.acme.com:9997,host502.acme.com:9997,host503.acme.com:9997,host504.acme.com:9997 ... View more

Had this issue with a 7.04 indexer/peer; restarted Splunk (had to kill -9 the old restart processes as they were causing restart to hang too) .. once restarted re-ran 'splunk offline --enforce-counts' and it worked fine. ... View more