Splunk Enterprise

What are the steps to set up HEC on a cluster

robertlynch2020
Motivator

Hi 

I am trying to send data into a cluster with 1 SH, 1MN and 3 indexers.

I am unsure if I

  • A: Send data to the search head then use the output groups to send the data to the indexers
  • B: Send the data directly to the indexers (However I don't have a way to load balance this data)

Regards

Robert

Labels (1)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

C. Stand up a heavy forwarder, set up HEC there, and let the HF load-balance to the indexers.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

C. Stand up a heavy forwarder, set up HEC there, and let the HF load-balance to the indexers.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

robertlynch2020
Motivator

Thanks for your help

0 Karma

PickleRick
Champion

As a bit of a further explanation - Search-heads are not normally used for event receiving. Maybe you could use them as forwarders (I'm not sure of that) but that's neither a typical use nor a supported one.

If you set up a HEC input on a single indexer you'd have a highly asymmetrical index distribution. If you set up a HEC input on multiple indexers, you'd need an external load-balancer. And again - distributed inputs are also not a supported setup. You usually supply indexer cluster with data from forwarders (in case of HEC you need Heavy Forwarder).

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!