Getting Data In

Best practices for HEC for on prem Splunk Distributed environment?

abhi04
Communicator

Hello All,

We have a splunk distributed environment with intermediate heavy forwarder tier and indexer tier.
We need to implement HEC in our current environment which will include how to write to multiple indexes with a single token and ensure some level of resiliency.Please let me know what will be the best approach for this.

0 Karma

lloydknight
Builder

Hi @abhi04

Though I'm not quite sure if there's a best practice on implementing HEC for Distributed deployment, you can apply persistent queues to improve the data input process and potentially prevent data loss.

Please see link below for more information regarding this:
https://docs.splunk.com/Documentation/Splunk/8.0.3/Data/Usepersistentqueues

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...