diff --git a/docs/configuration.md b/docs/configuration.md index abdf261..9860a3c 100644 --- a/docs/configuration.md +++ b/docs/configuration.md @@ -11,7 +11,8 @@ and variables needed to properly configure SC4S for your environment. | SPLUNK_HEC_TOKEN | string | Splunk HTTP Event Collector Token | * NOTE: Do _not_ configure HEC Acknowledgement when deploying the HEC token on the Splunk side; the underlying syslog-ng http -destination does not support this feature. Moreover, HEC would significantly degrade performance for streaming data such as syslog. +destination does not support this feature. Moreover, HEC Ack would significantly degrade performance for streaming data such as +syslog. ## Splunk HEC Destination Configuration diff --git a/docs/gettingstarted/docker-swarm-general.md b/docs/gettingstarted/docker-swarm-general.md index b9dc3a8..4d38ea2 100644 --- a/docs/gettingstarted/docker-swarm-general.md +++ b/docs/gettingstarted/docker-swarm-general.md @@ -111,7 +111,9 @@ SC4S_DEST_SPLUNK_HEC_WORKERS=6 #SC4S_DEST_SPLUNK_HEC_TLS_VERIFY=no ``` -* Update ``SPLUNK_HEC_URL`` and ``SPLUNK_HEC_TOKEN`` to reflect the correct values for your environment. +* Update ``SPLUNK_HEC_URL`` and ``SPLUNK_HEC_TOKEN`` to reflect the correct values for your environment. Do _not_ configure HEC +Acknowledgement when deploying the HEC token on the Splunk side; the underlying syslog-ng http destination does not support this +feature. Moreover, HEC Ack would significantly degrade performance for streaming data such as syslog. * Set `SC4S_DEST_SPLUNK_HEC_WORKERS` to match the number of indexers and/or HWFs with HEC endpoints, up to a maxiumum of 32. If the endpoint is a VIP, match this value to the total number of indexers behind the load balancer. diff --git a/docs/gettingstarted/docker-swarm-rhel7.md b/docs/gettingstarted/docker-swarm-rhel7.md index 58b4ffe..1c02bbb 100644 --- a/docs/gettingstarted/docker-swarm-rhel7.md +++ b/docs/gettingstarted/docker-swarm-rhel7.md @@ -119,7 +119,9 @@ SC4S_DEST_SPLUNK_HEC_WORKERS=6 #SC4S_DEST_SPLUNK_HEC_TLS_VERIFY=no ``` -* Update ``SPLUNK_HEC_URL`` and ``SPLUNK_HEC_TOKEN`` to reflect the correct values for your environment. +* Update ``SPLUNK_HEC_URL`` and ``SPLUNK_HEC_TOKEN`` to reflect the correct values for your environment. Do _not_ configure HEC +Acknowledgement when deploying the HEC token on the Splunk side; the underlying syslog-ng http destination does not support this +feature. Moreover, HEC Ack would significantly degrade performance for streaming data such as syslog. * Set `SC4S_DEST_SPLUNK_HEC_WORKERS` to match the number of indexers and/or HWFs with HEC endpoints, up to a maxiumum of 32. If the endpoint is a VIP, match this value to the total number of indexers behind the load balancer. diff --git a/docs/gettingstarted/docker-systemd-general.md b/docs/gettingstarted/docker-systemd-general.md index 2d3b0b6..bdbb78d 100644 --- a/docs/gettingstarted/docker-systemd-general.md +++ b/docs/gettingstarted/docker-systemd-general.md @@ -117,7 +117,9 @@ SC4S_DEST_SPLUNK_HEC_WORKERS=6 #SC4S_DEST_SPLUNK_HEC_TLS_VERIFY=no ``` -* Update ``SPLUNK_HEC_URL`` and ``SPLUNK_HEC_TOKEN`` to reflect the correct values for your environment +* Update ``SPLUNK_HEC_URL`` and ``SPLUNK_HEC_TOKEN`` to reflect the correct values for your environment. Do _not_ configure HEC +Acknowledgement when deploying the HEC token on the Splunk side; the underlying syslog-ng http destination does not support this +feature. Moreover, HEC Ack would significantly degrade performance for streaming data such as syslog. * Set `SC4S_DEST_SPLUNK_HEC_WORKERS` to match the number of indexers and/or HWFs with HEC endpoints, up to a maxiumum of 32. If the endpoint is a VIP, match this value to the total number of indexers behind the load balancer. diff --git a/docs/gettingstarted/podman-systemd-general.md b/docs/gettingstarted/podman-systemd-general.md index e4ab8c0..8c79df8 100644 --- a/docs/gettingstarted/podman-systemd-general.md +++ b/docs/gettingstarted/podman-systemd-general.md @@ -99,7 +99,9 @@ SC4S_DEST_SPLUNK_HEC_WORKERS=6 #SC4S_DEST_SPLUNK_HEC_TLS_VERIFY=no ``` -* Update ``SPLUNK_HEC_URL`` and ``SPLUNK_HEC_TOKEN`` to reflect the correct values for your environment +* Update ``SPLUNK_HEC_URL`` and ``SPLUNK_HEC_TOKEN`` to reflect the correct values for your environment. Do _not_ configure HEC +Acknowledgement when deploying the HEC token on the Splunk side; the underlying syslog-ng http destination does not support this +feature. Moreover, HEC Ack would significantly degrade performance for streaming data such as syslog. * Set `SC4S_DEST_SPLUNK_HEC_WORKERS` to match the number of indexers and/or HWFs with HEC endpoints, up to a maxiumum of 32. If the endpoint is a VIP, match this value to the total number of indexers behind the load balancer.