As a best practice which of the following should be used to ingest data on clustered indexers?
As a best practice which of the following should be used to ingest data on clustered indexers?
The best practice for ingesting data on clustered indexers involves using methods that ensure high availability and prevent data duplication. Splunktcp and splunktcp-ssl are designed for securely forwarding data between Splunk instances and handling data from remote inputs with high reliability. HTTP Event Collector (HEC) is ideal for ingesting data via REST API and supports load balancing, which mitigates the risk of single points of failure. This combination meets the requirements for robust, scalable data ingestion in clustered environments.
Answer should be D
must be D. ref: https://docs.splunk.com/Documentation/Splunk/9.2.0/Indexer/Indexerclusterinputs . while it is possible to use inputs.conf (B) it is not best practice for several reasons (e.g "To handle potential node failure"). see the link for details
It's not recommended to use modular inputs on Clustered Indexers, because each indexer will ingest data and that means you have duplicate data. For HEC you use a load-balancer to prevent ingest duplicate data and better to also prevent single point of failure.
The recommended method to ingest data on clustered indexers in Splunk is to use option B, which includes Modular inputs, HTTP Event Collector (HEC), and inputs.conf monitor stanza. Modular inputs are scripts or executables that can be run on remote systems to collect data and send it to Splunk. HEC is a data ingestion method that enables external systems to send data directly to Splunk via a REST API over HTTP or HTTPS. Inputs.conf monitor stanza is used to monitor local and network files for changes and ingest the data into Splunk. Options A and C are not recommended because they involve collecting data actively by monitoring systems and listening on ports. This approach can be resource-intensive and may affect the performance of the clustered indexers. Option D includes Splunk TCP and TCP-SSL, which are not commonly used for data ingestion on clustered indexers. These protocols are typically used for data forwarding between Splunk instances or for inputs that require secure communication, such as Splunk Enterprise Security.
b http collector