Splunk Connect for Syslog (SC4S) Mutiple HEC

[Mohammad-Mirasadollahi]

Hi
How can I add Mutiple HEC (Indexer) in SC4S configs for Load Balancing?

[ikheifets-splunk]

Hello, @Mohammad-Mirasadollahi !
It seems this question duplicating your question on Splunk user group.

My answer that we already making load balancing of indexers when you using HEC URL of Splunk stack and you don't need do it.
But if you wanna make it explicitly: SC4S_DEST_SPLUNK_HEC_DEFAULT_URL=https://indexer1,https://indexer2,https://indexer3

[Mohammad-Mirasadollahi]

What do you mean by the HEC URL of Splunk stack?
Do you mean I only need to add one HEC URL and the indexers will handle the load balancing themselves?

[ikheifets-splunk]

@Mohammad-Mirasadollahi if your Splunk Cloud url (what you see on browser) is https://some-stack.splunkcloud.com then you need use as HEC URL https://http-inputs-some-stack.splunkcloud.com

[Mohammad-Mirasadollahi]

In my scenario, I have only on-premises Splunk. As far as I know, if I add the Manager Node HEC URL, it will not automatically load balance to all Indexers in a cluster, and the Manager node itself receives the logs.
Correct me if I'm wrong please.