Getting Data In

How can I send HEC events to a VIP load balancing the indexers?

abhi04
Communicator

HI All,

I have 3 indexers and a VIP load balancing the 3 indexers. I want to send the http and https events using HEC to the VIP so that it load balances between the three indexers and sends it to them. How to do this?
Also, I do not want to send the HEC events to heavy forwarders and then it sends the it to the indexers. I have enabled the HEC directly on indexers. Do I have to create he same tokens across all the three indexers and then while sending it, include the that token and the vip ? Is it how it can be done? Or is there any other way to do so?

Labels (2)
0 Karma
1 Solution

abhi04
Communicator

Thanks @gcusello . This document setups the load balancer but I have the load balancer already setup which sits in front of the indexers. I want to send the events from the source to this load balancer which already jas been detup. Can this load balancer be mentioned while sending the HEC events?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @abhi04,
I understand that your Load Balancer is already configured, but you can see in the above urls the specifications for configuration so you can check your situation and verify that there isn't any configuration problem.
Anyway, yes, you can use the VIP as destination for the events.

Ciao.
Giuseppe

0 Karma

abhi04
Communicator

@gcusello Is the below command correct to send the events to loadbalancer which will send the events to one of the indexers?

curl -k -u "x:" LoadBalancer_VIP:8088/services/collector -d '{"sourcetype": "mysourcetype", "event":"Hello, World!"}'

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @abhi04,
on Internet there are many exaples to use HEC:
https://www.hurricanelabs.com/splunk-tutorials/how-to-set-up-splunk-hec-the-right-way
https://www.youtube.com/watch?v=9awwyjORWO8
https://www.youtube.com/watch?v=qROXrFGqWAU
Anyway, your example could be correct even if it's different from the example in the first link.

Ciao and Next Time.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...