The setup we have is as follow
Master x 1
Indexers x 3
Search head x 1
I am trying to enable HEC on the indexers through the inputs.conf and outputs.conf setup as described [here][1]
I have setup the local dir and added the inputs.conf and outputs.conf and restarted splunk but there is still nothing listening on port 8088
I did read this in the documentation
> Using HTTP Event Collector in a distributed deployment is incompatible with indexer clustering. Specifically, cluster peers are not supported as deployment clients.
https://docs.splunk.com/Documentation/Splunk/7.1.2/Data/UsetheHTTPEventCollector
Does this mean that I cannot enable HEC even though I am not using the deployment server to push this app out? We are manually editing the .conf files on each indexer.
[1]: http://dev.splunk.com/view/event-collector/SP-CAAAE6Q
↧