The Splunk HEC in version 6.4.0+ supports indexer acknowledgement on HEC data. This allows clients sending data to validate that data was not only received (successful POST) but also successfully processed, and then re-send data that failed to index.
The Splunk HEC in version 6.4.0+ supports indexer acknowledgement on HEC data. This allows clients sending data to validate that data was not only received (successful POST) but also successfully processed, and then re-send data that failed to index.
details
This would potentially add complexity and overhead that may not be worthwhile. Further investigation would be needed.