Splunk® Enterprise

Add AWS CloudTrail data with Kinesis Firehose: Distributed deployment with indexer clustering

Acrobat logo Download manual as PDF

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Acrobat logo Download topic as PDF

Distribute the HTTP Event Collector settings

Use the HTTP Event Collector (HEC) in a distributed Splunk platform deployment that uses indexer clustering. Place and distribute the HTTP Event Collector to indexer cluster peer nodes.

Use the configuration bundle method to distribute HEC configurations to the peer nodes. Using your HEC's port number, preferred protocol (HTTP or HTTPS), SSL settings, and HTTP Event Collector tokens, connect the HECs on your deployment's forwarders with the peer nodes of your deployment's indexer cluster. Tokens are managed centrally on the Splunk Enterprise instance running the cluster master.

See the Scale HTTP Event Collector with distributed deployments topic in the Getting Data In manual.

See the Update common peer configurations and apps topic in the Managing Indexers and Clustered Indexers manual.

Last modified on 12 June, 2019
Configure HTTP event collection
Configure Elastic Load Balancer settings

This documentation applies to the following versions of Splunk® Enterprise: 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters