Load Balancing Overview

In Splunk platform environments with multiple servers, each with their own configured HEC endpoints; a physical or logical load balancer is needed to distribute each request to each Splunk platform server. The collection of HEC endpoints can reside on either a cluster of Splunk heavy forwarders or Splunk indexers, depending on the specific environment configuration. If you use a load balancer, the address of the load balancer needs to be configured in the setting for HTTP Event Collector Endpoint (HEC) URL found on the Splunk Settings configuration page.