Understanding HEC input
HEC is an agentless input type that doesn’t require a forwarder on the source machine. This input type is suitable for sources that are capable of sending events over HTTP(S), such as web apps (through JavaScript libraries), mobile apps, and automation scripts. HEC exposes RESTful API endpoints on the Splunk Enterprise instance to accept data for indexing. The instance could be an HF/indexer in a distributed deployment. Let’s look at the key facts about HEC input:
- HEC is disabled by default on Splunk instances, and the user must enable it manually to start using it. HEC can be scaled by configuring it across multiple Splunk instances and optionally fronting it with a load balancer.
- Authentication to HEC APIs is done via a token supplied in the HTTP request sent by the source. The token configuration is set up by the administrator and shared with the application/source team for them to send over the events.
- HEC exposes two important...
