Distribute the HTTP Event Collector settings
Use the HTTP Event Collector (HEC) in a distributed Splunk platform deployment that uses indexer clustering. Place and distribute the HTTP Event Collector to indexer cluster peer nodes.
Use the configuration bundle method to distribute HEC configurations to the peer nodes. Using your HEC's port number, preferred protocol (HTTP or HTTPS), SSL settings, and HTTP Event Collector tokens, connect the HECs on your deployment's forwarders with the peer nodes of your deployment's indexer cluster. Tokens are managed centrally on the Splunk Enterprise instance running the cluster master.
See the Scale HTTP Event Collector with distributed deployments topic in the Getting Data In manual.
See the Update common peer configurations and apps topic in the Managing Indexers and Clustered Indexers manual.
This documentation applies to the following versions of Splunk® Enterprise: 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10
Download manual
Feedback submitted, thanks!